Potential Privilege Escalation via a Known SUID/SGID Binary

[rule]
description = """
This rule detects potential local privilege escalation attempts via known, pre-installed SUID/SGID binaries. Attackers
may abuse SUID/SGID binaries to escalate their privileges to root, using exploits or misconfigurations.
"""
id = "b1d415dc-796a-48f1-944f-4bb6037b2450"
license = "Elastic License v2"
name = "Potential Privilege Escalation via a Known SUID/SGID Binary"
os_list = ["linux"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.user.id == 0 and process.real_user.id != 0 and process.parent.user.id != 0) or
  (process.group.id == 0 and process.real_group.id != 0 and process.parent.group.id != 0)
) and
(
  (process.name == "unix_chkpwd" and process.args_count <= 2) or
  (
    process.name in ("fusermount", "fusermount3", "umount", "newgrp", "chsh") and
    process.args_count == 1
  ) or
  process.name in (
    "sudoedit", "gpasswd", "chfn", "polkit-agent-helper-1", "dbus-daemon-launch-helper", "ssh-keysign",
    "pam_extrausers_chkpwd", "expiry", "chage", "wall", "bsd-write", "ssh-agent",
    "ping6", "traceroute", "mtr", "ntfs-3g", "chrome-sandbox"
  )
) and
(
  process.parent.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*", "node", "deno", "bun", "java") or
  process.parent.executable like ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
  (
    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
    process.parent.args in ("-c", "-cl", "-lc", "--command", "-ic", "-ci", "-bash", "-sh", "-zsh", "-dash", "-fish", "-ksh", "-mksh") and
    process.parent.args_count <= 4
  )
) and
not (
  (process.name == "chage" and process.args == "-l" and process.args_count == 3) or
  (
    process.name == "sudoedit" and (
      (process.args == "-s" and process.args == "/") or
      process.args in ("--help", "-h") or
      process.args like "AAAAAA*"
    )
  ) or
  (process.name == "traceroute" and process.args_count == 2) or
  (process.executable == "/usr/bin/umount" and process.command_line == "umount") or
  process.executable like ("/tmp/newroot/*/chrome-sandbox", "/home/*/chrome-sandbox", "/tmp/newroot/usr/lib/polkit-1/polkit-agent-helper-1", "/opt/brave.com/brave/chrome-sandbox")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"

[[threat.technique.subtechnique]]
id = "T1548.003"
name = "Sudo and Sudo Caching"
reference = "https://attack.mitre.org/techniques/T1548/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.2.0"