Unusual Pkexec Execution

  1[metadata]
  2creation_date = "2025/01/16"
  3integration = ["endpoint", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/10/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects the execution of the `pkexec` command by a shell process. The `pkexec` command is used to execute
 11programs as another user, typically as the superuser. Through the `new_terms` rule type, unusual executions of `pkexec`
 12are identified, and may indicate an attempt to escalate privileges or perform unauthorized actions on the system.
 13"""
 14from = "now-9m"
 15index = [
 16    "logs-endpoint.events.process*",
 17    "endgame-*",
 18    "logs-sentinel_one_cloud_funnel.*",
 19]
 20language = "kuery"
 21license = "Elastic License v2"
 22name = "Unusual Pkexec Execution"
 23note = """## Triage and analysis
 24
 25> **Disclaimer**:
 26> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 27
 28### Investigating Unusual Pkexec Execution
 29
 30`Pkexec` is a command-line utility in Linux environments that allows users to execute commands as another user, often with elevated privileges. Adversaries may exploit `pkexec` to escalate privileges or execute unauthorized actions by invoking it through shell processes. The detection rule identifies atypical `pkexec` executions initiated by common shell interpreters, flagging potential misuse by monitoring specific process attributes and execution patterns.
 31
 32### Possible investigation steps
 33
 34- Review the process tree to understand the context of the pkexec execution, focusing on the parent process names such as bash, dash, sh, tcsh, csh, zsh, ksh, or fish, as these are indicative of shell-based invocations.
 35- Examine the command-line arguments passed to pkexec to determine the intended action and assess whether it aligns with expected administrative tasks or appears suspicious.
 36- Check the user account associated with the pkexec execution to verify if the account has legitimate reasons to perform such actions, and investigate any anomalies in user behavior or account activity.
 37- Investigate the timing and frequency of the pkexec executions to identify patterns or correlations with other suspicious activities or known attack timelines.
 38- Cross-reference the alert with other security logs and alerts from data sources like Elastic Endgame, Elastic Defend, Crowdstrike, or SentinelOne to gather additional context and corroborate findings.
 39- Assess the system's current state for signs of compromise, such as unauthorized changes, unexpected network connections, or the presence of known malicious files or processes.
 40
 41### False positive analysis
 42
 43- Routine administrative tasks: System administrators may use pkexec for legitimate purposes, such as performing maintenance tasks. To handle this, create exceptions for known administrator accounts or specific maintenance scripts that regularly invoke pkexec.
 44- Automated scripts: Some automated scripts or cron jobs might use pkexec to perform scheduled tasks. Identify these scripts and exclude their specific process names or paths from the rule to prevent false alerts.
 45- Software updates: Certain software update processes might use pkexec to apply patches or updates. Monitor and document these processes, then configure exceptions for recognized update mechanisms.
 46- Development environments: Developers might use pkexec during testing or development. Establish a list of development machines or user accounts and exclude them from the rule to reduce noise.
 47- Custom user applications: Users may have custom applications that require pkexec for legitimate functionality. Review these applications and whitelist their specific execution patterns to avoid unnecessary alerts.
 48
 49### Response and remediation
 50
 51- Immediately isolate the affected system from the network to prevent potential lateral movement by the adversary.
 52- Terminate any suspicious `pkexec` processes identified by the alert to halt unauthorized actions or privilege escalation attempts.
 53- Review and analyze the parent shell process and its command history to understand the context and origin of the `pkexec` execution.
 54- Reset credentials and review permissions for the user accounts involved to mitigate any unauthorized access or privilege escalation.
 55- Conduct a thorough scan of the affected system for additional indicators of compromise or persistence mechanisms that may have been deployed.
 56- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
 57- Update and enhance monitoring rules to detect similar `pkexec` misuse attempts in the future, ensuring comprehensive coverage of shell processes and privilege escalation activities."""
 58risk_score = 73
 59rule_id = "3ca81a95-d5af-4b77-b0ad-b02bc746f640"
 60setup = """## Setup
 61
 62This rule requires data coming in from one of the following integrations:
 63- Elastic Defend
 64
 65### Elastic Defend Integration Setup
 66Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 67
 68#### Prerequisite Requirements:
 69- Fleet is required for Elastic Defend.
 70- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 71
 72#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 73- Go to the Kibana home page and click "Add integrations".
 74- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 75- Click "Add Elastic Defend".
 76- Configure the integration name and optionally add a description.
 77- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 78- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 79- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 80- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 81For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 82- Click "Save and Continue".
 83- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 84For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 85"""
 86severity = "high"
 87tags = [
 88    "Domain: Endpoint",
 89    "OS: Linux",
 90    "Use Case: Threat Detection",
 91    "Tactic: Execution",
 92    "Tactic: Persistence",
 93    "Data Source: Elastic Endgame",
 94    "Data Source: Elastic Defend",
 95    "Data Source: SentinelOne",
 96    "Resources: Investigation Guide",
 97    "Noise: Low",
 98    "Performance: Normal",
 99    "Rule Type: New Terms",
100    "Platform: Linux",
101]
102timestamp_override = "event.ingested"
103type = "new_terms"
104query = '''
105event.category:process and host.os.type:linux and event.type:start and
106event.action:(exec or exec_event or start or ProcessRollup2) and process.name:pkexec and
107process.args:pkexec and process.parent.name:(bash or dash or sh or tcsh or csh or zsh or ksh or fish) and
108not (
109  process.args:(
110    "/usr/libexec/gvfsd-admin" or "udevadm" or "/opt/forticlient/stop-forticlient.sh" or "/usr/bin/gparted" or
111    "dpkg" or "/usr/sbin/gparted" or "input-remapper-control" or "/usr/lib/ubuntu-release-upgrader/do-partial-upgrade"
112  ) or
113  process.parent.command_line:*/home/*/.claude/shell-snapshots/* or
114  process.parent.args:"/usr/bin/timeshift-launcher"
115)
116'''
117
118[[rule.threat]]
119framework = "MITRE ATT&CK"
120
121[[rule.threat.technique]]
122id = "T1059"
123name = "Command and Scripting Interpreter"
124reference = "https://attack.mitre.org/techniques/T1059/"
125
126[[rule.threat.technique.subtechnique]]
127id = "T1059.004"
128name = "Unix Shell"
129reference = "https://attack.mitre.org/techniques/T1059/004/"
130
131[rule.threat.tactic]
132id = "TA0002"
133name = "Execution"
134reference = "https://attack.mitre.org/tactics/TA0002/"
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138
139[[rule.threat.technique]]
140id = "T1543"
141name = "Create or Modify System Process"
142reference = "https://attack.mitre.org/techniques/T1543/"
143
144[rule.threat.tactic]
145id = "TA0003"
146name = "Persistence"
147reference = "https://attack.mitre.org/tactics/TA0003/"
148
149[[rule.threat]]
150framework = "MITRE ATT&CK"
151
152[[rule.threat.technique]]
153id = "T1548"
154name = "Abuse Elevation Control Mechanism"
155reference = "https://attack.mitre.org/techniques/T1548/"
156
157[[rule.threat.technique.subtechnique]]
158id = "T1548.001"
159name = "Setuid and Setgid"
160reference = "https://attack.mitre.org/techniques/T1548/001/"
161
162[rule.threat.tactic]
163id = "TA0004"
164name = "Privilege Escalation"
165reference = "https://attack.mitre.org/tactics/TA0004/"
166[rule.new_terms]
167field = "new_terms_fields"
168value = ["process.parent.command_line"]
169
170[[rule.new_terms.history_window_start]]
171field = "history_window_start"
172value = "now-5d"