GitHub Repo

Analytics Story: Linux Privilege Escalation

Updated Date: 2026-05-13 ID: b9879c24-670a-44c0-895e-98cdb7d0e848 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.

Why it matters

Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Linux machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.

Linux Persistence and Privilege Escalation Risk Behavior

 1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
 2  WHERE (
 3        All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques")
 4        OR
 5        source = "*Linux*"
 6    )
 7    All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system"
 8  BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
 9| `drop_dm_object_name(All_Risk)`
10| `security_content_ctime(firstTime)`
11| `security_content_ctime(lastTime)`
12| where source_count >= 4
13| `linux_persistence_and_privilege_escalation_risk_behavior_filter`

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Linux Auditd Change File Owner To Root Linux and Mac Permissions Anomaly
Linux Auditd Whoami User Discovery System Owner/User Discovery Anomaly
Linux Possible Privilege Escalation via PYTHONPATH Exploitation for Privilege Escalation, Path Interception by PATH Environment Variable TTP
Linux Auditd Doas Conf File Creation Sudo and Sudo Caching TTP
Linux c89 Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Possible Access To Credential Files /etc/passwd and /etc/shadow Anomaly
Linux Auditd Service Started Service Execution Anomaly
Windows Suspicious QEMU Execution Data Obfuscation, Masquerading, Malicious File, Run Virtual Instance TTP
Linux Shred Overwrite Command Data Destruction TTP
Linux Doas Conf File Creation Sudo and Sudo Caching Anomaly
Linux Auditd Sysmon Service Stop Service Stop Anomaly
Linux File Creation In Profile Directory Unix Shell Configuration Modification Anomaly
Linux Auditd Private Keys and Certificate Enumeration Private Keys Anomaly
Linux Possible Nimbuspwn Privilege Escalation Exploitation for Privilege Escalation TTP
Linux Service Restarted Systemd Timers Anomaly
Linux Auditd Sudo Or Su Execution Sudo and Sudo Caching Anomaly
Linux Setuid Using Setcap Utility Setuid and Setgid Anomaly
Linux Shell Pseudo Device Reverse Shell Exfiltration Over Unencrypted Non-C2 Protocol, Command and Scripting Interpreter Anomaly
Linux Possible Cronjob Modification With Editor Cron Hunting
Linux File Created In Kernel Driver Directory Kernel Modules and Extensions Anomaly
Linux Octave Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd File Permissions Modification Via Chattr Linux and Mac Permissions Anomaly
Linux Auditd Find Credentials From Password Stores Password Managers TTP
Linux Auditd At Application Execution At Anomaly
Linux Binary Executed from Shared Memory Directory Command and Scripting Interpreter Anomaly
Linux Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Auditd Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Composer Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Possible Access Or Modification Of Sshd Config File SSH Authorized Keys Anomaly
Linux Auditd Service Restarted Systemd Timers Anomaly
Linux Auditd Setuid Using Chmod Utility Setuid and Setgid Anomaly
Linux OpenVPN Privilege Escalation Sudo and Sudo Caching Anomaly
Linux RPM Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Hidden Files And Directories Creation File and Directory Discovery Anomaly
Linux Possible GSM Privilege Escalation Exploitation for Privilege Escalation Anomaly
Linux Auditd Unload Module Via Modprobe Kernel Modules and Extensions TTP
Linux Emacs Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Root Execution of id System Owner/User Discovery Anomaly
Linux Auditd Insert Kernel Module Using Insmod Utility Kernel Modules and Extensions Anomaly
Linux Possible Ssh Key File Creation SSH Authorized Keys Anomaly
Linux c99 Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Unix Shell Configuration Modification Unix Shell Configuration Modification TTP
Linux pkexec Privilege Escalation Exploitation for Privilege Escalation TTP
Linux Auditd Doas Tool Execution Sudo and Sudo Caching Anomaly
Linux Possible Access To Credential Files /etc/passwd and /etc/shadow Anomaly
Linux At Allow Config File Creation Cron Anomaly
Linux Possible Append Command To Profile Config File Unix Shell Configuration Modification Anomaly
Linux Apparmor Bypass Via Aaexec Exploitation for Privilege Escalation TTP
Linux Possible Append Cronjob Entry on Existing Cronjob File Cron Hunting
Linux Suspicious Staging of Alternate System Files Masquerading Anomaly
Linux Setuid Using Chmod Utility Setuid and Setgid Anomaly
Linux Sqlite3 Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Add Files In Known Crontab Directories Cron Anomaly
Linux Busybox Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Usermod Root UID Set Valid Accounts, Account Manipulation, Setuid and Setgid TTP
Linux Auditd Install Kernel Module Using Modprobe Utility Kernel Modules and Extensions Anomaly
Linux Auditd Data Transfer Size Limits Via Split Syscall Data Transfer Size Limits Anomaly
Linux Auditd Setuid Using Setcap Utility Setuid and Setgid TTP
Linux Service Started Or Enabled Systemd Timers Anomaly
Linux Auditd Shred Overwrite Command Data Destruction TTP
Linux Auditd Add User Account Type Local Account Anomaly
Linux PF_ALG Registration Outside of Boot Window Exploitation for Privilege Escalation TTP
Linux Dirty Frag Kernel Privilege Escalation Exploitation for Privilege Escalation, Setuid and Setgid TTP
Linux Shell History Access Via Command Line Utility Shell History Anomaly
Linux Suspicious Privileged Container Execution Unix Shell, Deploy Container Anomaly
Linux Visudo Utility Execution Sudo and Sudo Caching Anomaly
Linux Puppet Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Docker Root Directory Mount Escape to Host TTP
Linux Suspicious Namespace Creation Exploitation for Privilege Escalation TTP
Linux Possible Access Or Modification Of sshd Config File SSH Authorized Keys Anomaly
Linux AWK Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Possible Append Command To At Allow Config File At Anomaly
Linux Service File Created In Systemd Directory Systemd Timers Anomaly
Linux Auditd System Network Configuration Discovery System Network Configuration Discovery Anomaly
Linux Change File Owner To Root Linux and Mac Permissions Anomaly
Linux Adding Crontab Using List Parameter Cron Hunting
Linux At Application Execution At Anomaly
Linux Sudoers Tmp File Creation Sudo and Sudo Caching Anomaly
Linux Docker Shell Execution Container CLI/API Anomaly
Linux Sudo OR Su Execution Sudo and Sudo Caching Hunting
Linux Node Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Copy Fail Privilege Escalation Exploitation for Privilege Escalation TTP
Linux Cpulimit Privilege Escalation Sudo and Sudo Caching Anomaly
Linux UDEV Rule Created Boot or Logon Initialization Scripts, Boot or Logon Autostart Execution Anomaly
Linux Auditd Preload Hijack Via Preload File Dynamic Linker Hijacking TTP
Linux Auditd Find Ssh Private Keys Private Keys Anomaly
Linux Auditd Virtual Disk File And Directory Discovery File and Directory Discovery Anomaly
Linux Csvtool Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Malformed Auth Entry Exploitation for Privilege Escalation Anomaly
Linux Auditd Nopasswd Entry In Sudoers File Sudo and Sudo Caching Anomaly
Linux Make Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Find Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Install Kernel Module Using Modprobe Utility Kernel Modules and Extensions Anomaly
Linux Suspicious Child Process of PostgreSQL Exploit Public-Facing Application TTP
Linux File Creation In Init Boot Directory RC Scripts Anomaly
Linux MySQL Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Edit Cron Table Parameter Cron Hunting
Linux Ruby Privilege Escalation Sudo and Sudo Caching Anomaly
Linux APT Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Suspicious Redis Activity Exploitation of Remote Services, Server Software Component TTP
Linux Auditd Add User Account Local Account Anomaly
Linux Common Process For Elevation Control Setuid and Setgid Hunting
Linux Auditd Find Credentials From Password Managers Password Managers TTP
Linux Auditd Data Transfer Size Limits Via Split Data Transfer Size Limits Anomaly
Linux Auditd Database File And Directory Discovery File and Directory Discovery Anomaly
Linux Insert Kernel Module Using Insmod Utility Kernel Modules and Extensions Anomaly
Linux Add User Account Local Account Hunting
Linux Gem Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Binary Launched Process with Null Argv Exploitation for Privilege Escalation TTP
Linux GNU Awk Privilege Escalation Sudo and Sudo Caching Anomaly
Linux Auditd File Permission Modification Via Chmod Linux and Mac Permissions Anomaly
Linux Pedit Offset Out Of Bounds Exploitation for Privilege Escalation TTP
Linux Auditd File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Auditd Service Stop Service Stop Anomaly
Windows SoftEther VPN Masquerading as Legitimate Binary Masquerading, Protocol Tunneling TTP
Linux Auditd Osquery Service Stop Service Stop Anomaly
Linux Auditd Possible Setuid Execve Privesc Exploitation for Privilege Escalation Anomaly
Linux Suspicious GCC Invocation Building Init Shared Object Compile After Delivery, Exploitation for Privilege Escalation, Shared Modules, Stage Capabilities TTP
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Cron Hunting
Linux GDB Privilege Escalation Sudo and Sudo Caching Anomaly
Linux NOPASSWD Entry In Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Edit Cron Table Parameter Cron Anomaly
Linux Auditd Disable Or Modify System Firewall Disable or Modify System Firewall Anomaly
Linux Auditd Kernel Module Using Rmmod Utility Kernel Modules and Extensions TTP
Linux Auditd Base64 Decode Files Deobfuscate/Decode Files or Information Anomaly
Linux Possible System Binary Backdoor Masquerading, Unix Shell Anomaly
Linux Doas Tool Execution Sudo and Sudo Caching Anomaly
Linux PHP Privilege Escalation Sudo and Sudo Caching Anomaly

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Linux Auditd Proctitle Linux icon Linux auditd auditd
Linux Auditd Syscall Linux icon Linux auditd auditd
Sysmon for Linux EventID 11 Linux icon Linux sysmon:linux Syslog:Linux-Sysmon/Operational
Linux Auditd Path Linux icon Linux auditd auditd
Linux Auditd Cwd Linux icon Linux auditd auditd
Sysmon for Linux EventID 1 Linux icon Linux sysmon:linux Syslog:Linux-Sysmon/Operational
Sysmon EventID 1 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Linux Auditd Service Stop Linux icon Linux auditd auditd
Linux Auditd Execve Linux icon Linux auditd auditd
Linux Auditd Add User Linux icon Linux auditd auditd
Linux Messages Syslog Linux icon Linux linux_messages_syslog /var/log/kern
Linux Secure Linux icon Linux linux_secure /var/log/secure
Cisco Isovalent Process Exec Other cisco:isovalent:processExec not_applicable

References

Source: GitHub | Version: 2