Potential Privilege Escalation via SUID/SGID

  1[metadata]
  2creation_date = "2026/05/18"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects potential privilege escalation under the root effective user when the real user and parent user are not
 11root, indicative of the execution of binaries with SUID or SGID bits set.
 12"""
 13false_positives = [
 14    """
 15    Some automation or break-glass tooling may invoke SUID binaries from scripts under /home; validate parent identity and
 16    change tickets before escalating.
 17    """,
 18]
 19from = "now-6m"
 20index = ["logs-endpoint.events.process*"]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Potential Privilege Escalation via SUID/SGID"
 24note = """## Triage and analysis
 25
 26### Investigating Potential Privilege Escalation via SUID/SGID
 27
 28Adversaries exploit misconfigured SUID/SGID binaries to gain elevated access or persistence. This rule identifies processes running with root privileges but initiated by non-root users, flagging potential misuse of SUID/SGID permissions.
 29
 30### Possible investigation steps
 31
 32- Inspect `process.parent.command_line` and working directory for obfuscation or one-liners.
 33- Check authentication and sudoers policy for the user.
 34- Pivot on the host for additional privilege escalation or persistence in the same session.
 35
 36### Response and remediation
 37
 38- If unauthorized, contain the session, revoke elevated access, and review sudoers and polkit policy for tampering.
 39"""
 40references = [
 41    "https://attack.mitre.org/techniques/T1548/",
 42]
 43risk_score = 73
 44rule_id = "769a2e72-11bd-437b-9503-e51e7790d273"
 45severity = "high"
 46tags = [
 47    "Data Source: Elastic Defend",
 48    "Domain: Endpoint",
 49    "OS: Linux",
 50    "Use Case: Threat Detection",
 51    "Tactic: Privilege Escalation",
 52    "Resources: Investigation Guide",
 53    "Noise: Low",
 54    "Performance: Normal",
 55    "Rule Type: Event Correlation (EQL)",
 56    "Platform: Linux",
 57]
 58timestamp_override = "event.ingested"
 59type = "eql"
 60query = '''
 61process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
 62  (process.user.id == "0" and process.real_user.id != "0" and process.parent.user.id != "0") or
 63  (process.group.id == "0" and process.real_group.id != "0" and process.parent.group.id != "0")
 64) and
 65(
 66  startsWith(process.executable, process.command_line) or
 67  startsWith(process.name, process.command_line)
 68) and
 69(
 70  process.parent.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*", "node", "deno", "bun", "java") or
 71  process.parent.executable like ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
 72  (
 73    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
 74    process.parent.args in ("-c", "-cl", "-lc", "--command", "-ic", "-ci", "-bash", "-sh", "-zsh", "-dash", "-fish", "-ksh", "-mksh") and
 75    process.parent.args_count <= 4
 76  )
 77) and
 78not (
 79  /* Common SUID/SGID binaries (subset also covered by e7856173-6489-449f-80ec-c1f5fcd7b87c); excluded here to reduce noise */
 80  process.name in (
 81    "unix_chkpwd", "fusermount", "fusermount3", "umount", "newgrp", "chsh", "sudoedit", "gpasswd", "chfn", "polkit-agent-helper-1",
 82    "dbus-daemon-launch-helper", "ssh-keysign", "pam_extrausers_chkpwd", "expiry", "chage", "wall", "bsd-write", "ssh-agent",
 83    "ping6", "traceroute", "mtr", "ntfs-3g", "Xorg.wrap", "chrome-sandbox", "bwrap", "hostname", "sudo", "su", "pkexec", "passwd",
 84    "mount"
 85  ) or
 86  (process.executable == "/usr/lib/landscape/apt-update" and process.args == "/usr/lib/landscape/apt-update") or
 87  (process.executable == "/usr/bin/mount" and process.args in ("/usr/bin/mount", "mount")) or
 88  (process.executable like "/u0?/app/agent/agent_*/sbin/nmo" and process.args like "/u0?/app/agent/agent_*/sbin/nmo") or
 89  (process.executable == "/usr/bin/screen" and process.args == "screen") or
 90  (process.executable == "/usr/sbin/playpen" and process.args == "/usr/sbin/playpen")
 91)
 92'''
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96
 97[[rule.threat.technique]]
 98id = "T1548"
 99name = "Abuse Elevation Control Mechanism"
100reference = "https://attack.mitre.org/techniques/T1548/"
101
102[[rule.threat.technique.subtechnique]]
103id = "T1548.001"
104name = "Setuid and Setgid"
105reference = "https://attack.mitre.org/techniques/T1548/001/"
106
107[rule.threat.tactic]
108id = "TA0004"
109name = "Privilege Escalation"
110reference = "https://attack.mitre.org/tactics/TA0004/"