Linux Sudo Chroot Execution

 1title: Linux Sudo Chroot Execution
 2id: f2bed782-994e-4f40-9cd5-518198cb3fba
 3status: experimental
 4description: |
 5    Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
 6    Attackers may use this technique to evade detection and execute commands in a modified environment.
 7    This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
 8    While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.    
 9references:
10    - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
11author: Swachchhanda Shrawn Poudel (Nextron Systems)
12date: 2025-10-02
13tags:
14    - attack.privilege-escalation
15    - attack.t1068
16logsource:
17    category: process_creation
18    product: linux
19detection:
20    selection:
21        Image|endswith: '/sudo'
22        CommandLine|contains:
23            - ' --chroot '
24            - 'sudo -R '
25    condition: selection
26falsepositives:
27    - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.
28level: low