XQL query for critical commands

[R.Daz588554]

Hi everyone.
I'm trying to create an XQL query for a BIOC that will trigger an alert when specific commands are run.
I've tried the "visudo" and "sudo -l" commands on two servers. On one it detects both commands and on the other it only detects the "visudo" command.
The XQL query is as follows:

dataset = xdr_data
| filter event_type = ENUM.PROCESS and
event_sub_type = ENUM.PROCESS_START and
actor_process_command_line contains "visudo" or
actor_process_command_line contains "sudo -l"

Can you tell me if I'm choosing the correct fields for the query? Any idea how I can achieve my goal?

[jmazzeo]

Hi @R.Daz588554, thanks for reaching us using the Live Community.

Are both servers the same distro? Maybe how the server runs the "sudo" command is different, try removing the event_type and event_sub_type filters.

[R.Daz588554]

The solution is to use:
actor_process_command_line in ("visudo*", "sudo -l*")

Thanks