Suspicious SUID Binary Execution

  1[metadata]
  2creation_date = "2026/04/30"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/05/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects execution of SUID binaries that may be used for privilege escalation under the root effective user
 11when the real user and parent user are not root, combined with minimal argument counts and suspicious parent
 12context (interpreters, short shell -c invocations, or parents running from user-writable paths) to indicate
 13potential misuse of SUID binaries for privilege escalation.
 14"""
 15false_positives = [
 16    """
 17    Some automation or break-glass tooling may invoke SUID binaries from scripts under /home; validate parent identity and
 18    change tickets before escalating.
 19    """,
 20]
 21from = "now-6m"
 22index = ["logs-endpoint.events.process*"]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Suspicious SUID Binary Execution"
 26note = """## Triage and analysis
 27
 28### Investigating Suspicious SUID Binary Execution
 29
 30Confirm whether the non-root real user should be invoking SUID binaries as root. Review the parent process tree, script path, and any preceding download or decode activity.
 31
 32### Possible investigation steps
 33
 34- Inspect `process.parent.command_line` and working directory for obfuscation or one-liners.
 35- Check authentication and sudoers policy for the user.
 36- Pivot on the host for additional privilege escalation or persistence in the same session.
 37
 38### Response and remediation
 39
 40- If unauthorized, contain the session, revoke elevated access, and review sudoers and polkit policy for tampering.
 41"""
 42references = [
 43    "https://attack.mitre.org/techniques/T1548/",
 44]
 45risk_score = 73
 46rule_id = "e7856173-6489-449f-80ec-c1f5fcd7b87c"
 47severity = "high"
 48tags = [
 49    "Data Source: Elastic Defend",
 50    "Domain: Endpoint",
 51    "OS: Linux",
 52    "Use Case: Threat Detection",
 53    "Tactic: Privilege Escalation",
 54    "Resources: Investigation Guide",
 55]
 56timestamp_override = "event.ingested"
 57type = "eql"
 58query = '''
 59process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
 60  (process.user.id == "0" and process.real_user.id != "0" and process.parent.user.id != "0") or
 61  (process.group.id == "0" and process.real_group.id != "0" and process.parent.group.id != "0")
 62) and
 63(
 64  (process.name in ("su", "passwd", "unix_chkpwd") and process.args_count <= 2) or
 65  (
 66    process.name in ("sudo", "pkexec", "fusermount", "fusermount3", "mount", "umount", "newgrp", "chsh") and
 67    process.args_count == 1
 68  ) or
 69  process.name in (
 70    "sudoedit", "gpasswd", "chfn", "polkit-agent-helper-1", "dbus-daemon-launch-helper", "ssh-keysign",
 71    "pam_extrausers_chkpwd", "expiry", "chage", "crontab", "wall", "bsd-write", "ssh-agent", "ping",
 72    "ping6", "traceroute", "mtr", "ntfs-3g", "Xorg.wrap", "chrome-sandbox", "bwrap"
 73  )
 74) and
 75(
 76  process.parent.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*", "node", "deno", "bun", "java") or
 77  process.parent.executable like ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
 78  (
 79    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
 80    process.parent.args in ("-c", "-cl", "-lc", "--command", "-ic", "-ci", "-bash", "-sh", "-zsh", "-dash", "-fish", "-ksh", "-mksh") and
 81    process.parent.args_count <= 4
 82  )
 83)
 84'''
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88
 89[[rule.threat.technique]]
 90id = "T1548"
 91name = "Abuse Elevation Control Mechanism"
 92reference = "https://attack.mitre.org/techniques/T1548/"
 93
 94[[rule.threat.technique.subtechnique]]
 95id = "T1548.001"
 96name = "Setuid and Setgid"
 97reference = "https://attack.mitre.org/techniques/T1548/001/"
 98
 99[[rule.threat.technique.subtechnique]]
100id = "T1548.003"
101name = "Sudo and Sudo Caching"
102reference = "https://attack.mitre.org/techniques/T1548/003/"
103
104[rule.threat.tactic]
105id = "TA0004"
106name = "Privilege Escalation"
107reference = "https://attack.mitre.org/tactics/TA0004/"