Detection of Root-Level Execution of the 'id' Command on Linux

The 'id' command is a standard Linux utility used to display user and group information. While its usage is benign in many administrative contexts, it is commonly leveraged by threat actors during post-exploitation to confirm that a privilege escalation attempt has successfully granted them root-level access. Detecting this command when executed under the 'root' context provides security teams with visibility into potential malicious discovery activities. This activity is significant as it indicates an attacker is actively profiling their environment or confirming superuser status, which often precedes further malicious actions such as exfiltration, system destruction, or the establishment of persistent unauthorized access. Defenders should tune detections to account for legitimate administrative tasks or automated maintenance scripts that may perform this check.

Impact

Successful exploitation where an attacker confirms root privileges typically indicates an advanced stage of a breach. If left unmonitored, compromised systems with root-level access permit attackers to move laterally across the network, modify critical system configuration files, install persistent backdoors, or exfiltrate sensitive data.

Recommendation

• Deploy the Sigma rule below to monitor for 'id' execution by the root user.
• Ingest Sysmon for Linux Event ID 1 (process creation) logs into your SIEM, ensuring process names and command lines are captured.
• Establish a baseline of known-good administrative users and automated service accounts that legitimately invoke 'id' as root to tune out false positives.
• Integrate process lineage data (parent-child process relationships) to differentiate between legitimate service management and anomalous execution triggered by shells or unauthorized binaries.