Skip to content
Threat Feed
Subscribe

Tag

Sgid

4 briefs RSS
high advisory

Unusual Child Process Execution by Web Servers on Linux

This detection rule identifies suspicious child process executions originating from web server processes on Linux systems, indicating that attackers may have exploited web application vulnerabilities such as command injection or remote file inclusion to establish persistence or execute malicious commands.

Elastic Defend +45 persistence execution command-and-control initial-access linux webserver webshell privilege-escalation +4
2r 5t 13i updated
high advisory

Potential Privilege Escalation via SUID/SGID on Linux

This rule detects potential privilege escalation under the root effective user when the real user and parent user are not root, indicative of the execution of binaries with SUID or SGID bits set, often exploited by adversaries to gain elevated access on Linux systems.

Elastic Endpoint Security privilege-escalation suid sgid linux
3r 2t
medium advisory

Potential Privilege Escalation via SUID/SGID on Linux

Attackers may leverage misconfigured SUID/SGID permissions on Linux systems to escalate privileges to root or establish persistence by executing processes with root privileges initiated by non-root users.

Elastic Defend privilege-escalation persistence defense-evasion suid sgid
2r 2t
medium advisory

Potential Privilege Escalation via SUID/SGID Abuse on Linux

This rule detects potential privilege escalation attempts on Linux systems by identifying processes running with root privileges but initiated by non-root users, indicative of SUID/SGID abuse.

Elastic Defend privilege-escalation persistence suid sgid
2r 3t