Potential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651

[rule]
description = """
Detects execution from a Debian postinst followed by a process whose executable path appears in that earlier command
line while effective user ID is root and real user ID is not zero. This matches malicious package post-install dropping
a setuid-style binary and aligns with CVE-2026-41651 PackageKit TOCTOU local privilege escalation behavior.
"""
id = "8f3e1c62-4a8b-4d91-b9e7-ace24165100a"
license = "Elastic License v2"
name = "Potential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651"
os_list = ["linux"]
reference = ["https://github.com/Vozec/CVE-2026-41651", "https://github.com/advisories/GHSA-f55j-vvr9-69xv"]
version = "1.0.1"

query = '''
sequence with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and
   (
     process.parent.executable like "/var/lib/dpkg/info/*.postinst" or
     process.parent.args like "/var/lib/dpkg/info/*.postinst"
   )
  ] as event0
  [process where event.type == "start" and event.action == "exec" and user.id == 0 and
   user.Ext.real.id != 0 and stringcontains~(event0.process.command_line, process.executable)]
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.6.0"