The sudoers file,/etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line likeuser1 ALL=(ALL) NOPASSWD: ALL(Citation: OSX.Dok Malware).Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.
Detection: On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).
Platforms: Linux, macOS
Data Sources: File monitoring
Effective Permissions: root
Permissions Required: User
Common Sudo enumeration methods.
Supported Platforms: macOS, Linux
sudo -l
sudo su
cat /etc/sudoers
vim /etc/sudoers