{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/linux-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["su","sudo","mount","umount","fusermount3","passwd","chfn","chsh","gpasswd","newgrp","unix_chkpwd","newuidmap","newgidmap","dbus-daemon-launch-helper","ssh-keysign","pkexec","polkit-agent-helper-1","snap-confine"],"_cs_severities":["medium"],"_cs_tags":["privilege-escalation","linux-security","defense-evasion","persistence","system-exploitation"],"_cs_type":"advisory","_cs_vendors":["Canonical","KDE","GNOME","OpenSSH","Oracle","Polkit","XFCE"],"content_html":"\u003cp\u003eThis threat brief details how attackers can achieve privilege escalation on Linux systems by abusing binaries with the SUID (Set User ID) or SGID (Set Group ID) bit set. This technique allows a process to run with the permissions of the file owner (usually root) or group, regardless of the user who executed it. Attackers, having already established a low-privileged foothold, identify and exploit vulnerabilities or misconfigurations in these SUID/SGID binaries, such as \u003ccode\u003epkexec\u003c/code\u003e, \u003ccode\u003esu\u003c/code\u003e, or \u003ccode\u003esudo\u003c/code\u003e. By manipulating environment variables or providing crafted inputs, they can coerce these binaries to execute arbitrary commands or spawn a shell with root privileges, thereby escalating their access to full system control. This method is a common way for adversaries to transition from initial access to a persistent, high-privileged presence on a compromised system.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial low-privileged access to a Linux system, often through a vulnerable service, compromised credentials, or an exploit.\u003c/li\u003e\n\u003cli\u003eThe attacker performs reconnaissance to identify SUID/SGID binaries present on the system (e.g., \u003ccode\u003epkexec\u003c/code\u003e, \u003ccode\u003esu\u003c/code\u003e, \u003ccode\u003esudo\u003c/code\u003e, \u003ccode\u003efusermount3\u003c/code\u003e, \u003ccode\u003enewuidmap\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker researches known vulnerabilities, misconfigurations, or exploitation techniques specific to the identified SUID/SGID binaries (e.g., environment variable manipulation for \u003ccode\u003epkexec\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eA crafted exploit is prepared, which typically involves setting specific environment variables, passing malicious arguments, or using input redirection.\u003c/li\u003e\n\u003cli\u003eThe SUID/SGID binary is executed by the low-privileged user, triggering the exploit.\u003c/li\u003e\n\u003cli\u003eDue to the SUID/SGID bit, the executed binary runs with elevated privileges (e.g., as UID 0/root) while the attacker's real user ID remains non-root.\u003c/li\u003e\n\u003cli\u003eThe exploit causes the SUID/SGID binary to execute an arbitrary command or spawn a shell (e.g., \u003ccode\u003e/bin/sh -p\u003c/code\u003e) with root privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker gains full root access to the compromised system, allowing for system modification, data access, and further lateral movement or persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf this privilege escalation technique succeeds, an attacker gains complete control over the compromised Linux system. This includes the ability to install rootkits, modify system configurations, create new privileged accounts, access sensitive data, exfiltrate information, and deploy additional malware such as ransomware. While specific victim counts or targeted sectors are not detailed for this general technique, organizations across all sectors using Linux systems are vulnerable if their SUID/SGID binaries are misconfigured or unpatched. The primary damage is the loss of system integrity and confidentiality, potentially leading to significant operational disruption and data breaches.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM and tune for your environment to detect suspicious SUID/SGID proxy executions.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive process creation logging (e.g., Elastic Defend, Linux Auditd) to capture \u003ccode\u003eprocess.user.id\u003c/code\u003e, \u003ccode\u003eprocess.real_user.id\u003c/code\u003e, \u003ccode\u003eprocess.group.id\u003c/code\u003e, \u003ccode\u003eprocess.real_group.id\u003c/code\u003e, \u003ccode\u003eImage\u003c/code\u003e, \u003ccode\u003eParentImage\u003c/code\u003e, and \u003ccode\u003eCommandLine\u003c/code\u003e for accurate detection.\u003c/li\u003e\n\u003cli\u003eInvestigate any triggered alerts by correlating events with TTY/SSH sessions, authentication logs, and polkit policy outcomes, as suggested in the Elastic investigation guide.\u003c/li\u003e\n\u003cli\u003eImmediately isolate affected hosts, terminate malicious SUID/SGID child processes, and temporarily remove the setuid/setgid bit from any abused binaries (e.g., \u003ccode\u003echmod u-s /usr/bin/pkexec\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eReinstall and verify the integrity of abused SUID/SGID binaries and packages (e.g., \u003ccode\u003epolkit\u003c/code\u003e for \u003ccode\u003epkexec\u003c/code\u003e) and remove any attacker-created artifacts from \u003ccode\u003e/tmp\u003c/code\u003e, \u003ccode\u003e/var/tmp\u003c/code\u003e, and user home directories.\u003c/li\u003e\n\u003cli\u003eAudit and reduce the SUID/SGID attack surface by removing the setuid bits from rarely used binaries (e.g., \u003ccode\u003echfn\u003c/code\u003e, \u003ccode\u003echsh\u003c/code\u003e, \u003ccode\u003enewgrp\u003c/code\u003e, \u003ccode\u003essh-keysign\u003c/code\u003e) and restricting \u003ccode\u003epkexec\u003c/code\u003e via \u003ccode\u003epolkit\u003c/code\u003e rules.\u003c/li\u003e\n\u003cli\u003eStrengthen monitoring by enabling AppArmor/SELinux confinement for SUID/SGID helpers, adding \u003ccode\u003eauditd\u003c/code\u003e rules for execution of setuid binaries and writes to \u003ccode\u003e/tmp\u003c/code\u003e by root, and enforcing least-privilege \u003ccode\u003esudoers\u003c/code\u003e configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T12:44:03Z","date_published":"2026-07-20T12:44:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-linux-suid-sgid-privesc/","summary":"Attackers may exploit SUID/SGID binaries like pkexec, su, or sudo on Linux systems to execute commands with elevated privileges, by identifying instances where a process runs with root privileges (user ID 0 or group ID 0) while the real user or group ID is non-root, allowing a low-privilege foothold to gain full system control.","title":"Potential Privilege Escalation via SUID/SGID Proxy Execution on Linux","url":"https://feed.craftedsignal.io/briefs/2026-07-linux-suid-sgid-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux-Security","version":"https://jsonfeed.org/version/1.1"}