Skip to content
Threat Feed

Product

Logs-Auditd_manager.auditd-*

1 brief RSS
medium advisory

Suspicious SUID Binary Execution Sequence on Linux

This rule detects suspicious sequences where a non-root user launches a high-risk parent process and then executes a common privilege elevation helper gaining an effective UID of 0 while the real UID remains non-root, potentially indicating misuse of SUID/SGID helpers or privilege escalation attempts.

auditbeat-* +1 privilege-escalation linux suid
2r 2t