Auditd

This detection brief addresses the use of the 'whoami' command on Linux systems for post-exploitation reconnaissance to identify user identity and privilege levels.

Adversaries leverage service termination techniques on Linux systems to disable security controls and disrupt operations, as documented in the Industroyer2 malware campaign.

This detection targets adversary efforts to perform credential dumping on Linux systems by monitoring for the usage of standard utilities to access /etc/passwd and /etc/shadow files.

This detection monitors for the execution of the 'insmod' utility on Linux systems, a technique frequently leveraged by attackers to deploy rootkits, gain kernel-level persistence, and escalate privileges.

This detection identifies suspicious reconnaissance activity on Linux systems where utilities like find or grep are used to locate sensitive document files, a technique commonly used by attackers for data identification and exfiltration.

Adversaries utilize the dd command to irreversibly overwrite system files with null bytes, facilitating data destruction and service disruption.

This detection monitors for the creation of new user accounts on Linux systems, a common technique employed by adversaries to establish persistence on compromised hosts.

Detection of unauthorized modifications to shell configuration files (e.g., .bashrc, .profile) used by attackers for persistence and privilege escalation on Linux systems.

Elastic has developed a detection rule that monitors non-allowlisted `wget` activity on Linux hosts using Auditd Manager or Auditbeat, leveraging an Elastic LLM to triage `wget` executions for potential ingress tool transfer, command and control, or data exfiltration attempts to untrusted destinations, generating alerts only for high-confidence positive or suspicious verdicts.

Elastic has released a detection rule to identify the use of the `nsenter` utility targeting a Process ID (PID) with specific namespace flags on Linux systems, a technique commonly employed by attackers to escape container environments or escalate privileges by gaining host context.

This brief describes a Linux privilege escalation technique where an unprivileged user executes a setuid-root binary from a non-standard path with a privileged shell flag (e.g., -p), allowing them to regain root context after initial local exploitation, detectable via Auditd logs.

This rule identifies process execution events where the effective user is root while the real user is not, the process arguments include the privileged shell flag commonly associated with setuid-capable shells, and the executable path is outside standard system binary directories, indicating potential privilege escalation.

The rule detects a sequence of events indicating a potential privilege escalation attempt on Linux systems where a non-root user performs namespace activity using unshare, followed by the execution of a root process shortly after.

This rule detects the execution of curl or wget from within runc-backed containers on Linux systems monitored by Auditd Manager, indicating potential ingress tool transfer or data exfiltration by attackers who have compromised the container.

This analytic detects unexpected shutdowns of the Linux auditd daemon, potentially indicating attempts to disable security monitoring and evade detection by attackers.

This rule detects suspicious processes, such as copy utilities or scripting tools, accessing sensitive identity files on Linux systems, including Kubernetes tokens, cloud CLI configurations, and root SSH keys, indicating potential credential theft.

Detection of abnormal Linux audit daemon (auditd) termination via DAEMON_ABORT events, indicating potential auditing subsystem failure due to resource exhaustion, corruption, or malicious interference.

Detection of Linux audit daemon (auditd) re-initialization events, which can indicate attempts to re-enable audit logging after evasion or restarts with modified rule sets.