Some Images and one technique Added

rules/linux/process_creation/proc_creation_lnx_cat_sudoers.yml

@@ -4,23 +4,31 @@ status: test
 description: Detects the execution of a cat /etc/sudoers to list all users that have sudo rights
 references:
     - https://github.com/sleventyeleven/linuxprivchecker/
-author: Florian Roth (Nextron Systems)
+author: Florian Roth (Nextron Systems), CheraghiMilad
 date: 2022-06-20
-modified: 2022-09-15
+modified: 2024-12-10
 tags:
     - attack.reconnaissance
     - attack.t1592.004
 logsource:
     category: process_creation
     product: linux
 detection:
-    selection:
+    selection_1:
+        Image|endswith: '/visudo'
+    selection_2:
         Image|endswith:
+            - '/grep'
             - '/cat'
-            - 'grep'
+            - '/ed'
             - '/head'
-            - '/tail'
             - '/more'
+            - '/nano'
+            - '/tail'
+            - '/less'
+            - '/vi'
+            - '/vim'
+            - '/emacs'
         CommandLine|contains: ' /etc/sudoers'
     condition: selection
 falsepositives: