The article demonstrates how Wazuh detects multiple Linux privilege escalation techniques, including sudo abuse, SUID/SGID misuse, group membership changes, ptrace injection, dynamic linker hijacking, and cron abuse. It also shows the auditd, File Integrity Monitoring, and custom rule configurations used to generate alerts for these attacks on Ubuntu endpoints. #Wazuh #auditd #GTFOBins #ptrace #ld.so.preload #sudoers #crontab
Keypoints
- Wazuh is used to detect common Linux privilege escalation techniques on Ubuntu endpoints.
- The article covers six main abuse paths: sudo caching, SUID/SGID, privileged groups, ptrace-based process injection, dynamic linker hijacking, and cron/logrotate abuse.
- Auditd is configured to monitor relevant syscalls and file writes that indicate privilege escalation activity.
- Wazuh FIM is used to watch sensitive files and directories such as /etc/sudoers, /etc/group, /etc/ld.so.preload, and cron/logrotate paths.
- Custom Wazuh rules are created in a linux_privesc.xml file to map detections to MITRE ATT&CK techniques.
- The post includes attack simulations showing how each technique triggers alerts in the Wazuh dashboard.
- The conclusion emphasizes combining auditd, FIM, and custom rules to improve visibility into privilege escalation attempts.
MITRE Techniques
- [T1548.003 ] Abuse elevation control mechanism: Sudo and sudo caching – sudo is abused through misconfigured /etc/sudoers entries and NOPASSWD access to run a sensitive binary as root (‘Run sudo -l to enumerate which commands the compromised account can execute through sudo’ and ‘a NOPASSWD entry … can allow an attacker to obtain a root shell’).
- [T1548.001 ] Abuse elevation control mechanism: Setuid and Setgid – SUID/SGID bits are abused by setting them on a copied shell or finding exploitable SUID binaries to obtain root privileges (‘copy /bin/bash … and set the SUID bit directly’).
- [T1098.007 ] Account manipulation: Additional local or domain groups – a compromised user is added to privileged groups such as sudo or wheel to gain root access (‘execute usermod -aG sudo ‘).
- [T1055 ] Process injection – ptrace is used to attach to another process and inject code into a privileged process (‘Attach to the process with ptrace(PTRACE_ATTACH, …)’ and ‘Inject shellcode or a shared library path’).
- [T1574.006 ] Hijack execution flow: Dynamic linker hijacking – attackers abuse LD_PRELOAD or /etc/ld.so.preload so a malicious shared library loads with elevated privileges (‘if LD_PRELOAD is set to a malicious shared library, the library is loaded with the process’s elevated permissions’).
- [T1053.003 ] Scheduled task/job: Cron – cron and logrotate configurations are modified to execute attacker-controlled commands as root (‘drop or edit a cron job entry that runs a payload as root’ and ‘inject a postrotate script directive’).
Indicators of Compromise
- [File paths ] Monitored configuration and target files for privilege escalation detection – /var/ossec/etc/ossec.conf, /etc/sudoers, and /etc/ld.so.preload.
- [File paths ] Cron and logrotate paths used in simulations and monitoring – /etc/cron.d/privesc-test, /etc/logrotate.d/privesc-test, and /etc/crontab.
- [File paths ] Writable locations used for test binaries and payloads – /var/tmp/rootbash, /var/tmp/escalated, /var/tmp/cron_path_test, and /tmp/evil.so.
- [Auditd keys ] Custom audit keys used to tag events – priv_esc_sudo, priv_esc_setuid, priv_esc_group, priv_esc_ptrace, priv_esc_dynlinker, priv_esc_cron, and priv_esc_cron_path.
- [Rule files ] Wazuh custom rules file referenced in the article – linux_privesc.xml.
- [System binaries ] Binaries referenced in attacks or detection logic – /usr/bin/find, /usr/sbin/usermod, /usr/sbin/groupmod, and /usr/lib/cargo/bin/sudo.
Read more: https://wazuh.com/blog/detecting-common-linux-privilege-escalation-techniques-with-wazuh/