Elastic Security Detection Rules

Excessive Sudo Authentication Failures via macOS Security Events

Last updated 15 days ago on 2026-10-06
Created a month ago on 2026-09-17

About

Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges.
Tags
Domain: EndpointOS: macOSPlatform: macOSUse Case: Threat DetectionTactic: Privilege EscalationTactic: Credential AccessData Source: macOS Security EventsRule Type: ESQLLanguage: esql
Severity
low
Risk Score
21
MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Abuse Elevation Control Mechanism (T1548)(external, opens in a new tab or window)

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Brute Force (T1110)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

macos(external, opens in a new tab or window)

Query
text code block:
FROM logs-macos.authentication-*
| WHERE data_stream.dataset == "macos.authentication" and
    macos.process.image_path LIKE "*/sudo" and
    macos.event.message.description LIKE "*incorrect password attempt*"
| GROK macos.event.message.description "%{NOTSPACE:user_name} : %{NUMBER:attempt_count:int} incorrect password attempt%{DATA} ; TTY=%{NOTSPACE:tty} ; PWD=%{DATA:pwd} ; USER=%{NOTSPACE:target_user} ; COMMAND=%{GREEDYDATA:command}"
| STATS
    Esql.failure_event_count = COUNT(*),
    Esql.attempt_total = SUM(attempt_count),
    Esql.user_name_values = VALUES(user_name),
    Esql.target_user_values = VALUES(target_user),
    Esql.tty_values = VALUES(tty),
    Esql.command_values = VALUES(command)
  BY host.id, host.name
| WHERE Esql.attempt_total >= 10
| KEEP host.id, host.name, Esql.failure_event_count, Esql.attempt_total, Esql.user_name_values, Esql.target_user_values, Esql.tty_values, Esql.command_values

Install detection rules in Elastic Security

Detect Excessive Sudo Authentication Failures via macOS Security Events in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).