{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/unshare/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elastic Defend","Elastic Endpoint"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","unshare","namespace"],"_cs_type":"advisory","_cs_vendors":["Elastic","Ubuntu"],"content_html":"\u003cp\u003eThis detection rule identifies potential privilege escalation attempts on Linux systems by monitoring the use of the \u003ccode\u003eunshare\u003c/code\u003e command and subsequent UID changes to root. The \u003ccode\u003eunshare\u003c/code\u003e command is used to create new namespaces, including user namespaces, which can be leveraged in exploit chains. Attackers may use \u003ccode\u003eunshare\u003c/code\u003e with user namespace flags as a preliminary step before escalating privileges to root. This behavior can indicate successful exploitation of vulnerabilities, such as those related to OverlayFS, or other local privilege escalation techniques. This detection is intentionally generic to surface multiple local privilege escalation patterns beyond a single CVE. The rule focuses on detecting a sequence of events where a non-root user executes \u003ccode\u003eunshare\u003c/code\u003e with user-namespace related arguments followed by a UID change event indicating the user has become root.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA non-root user executes the \u003ccode\u003eunshare\u003c/code\u003e command with arguments indicating the creation of a new user namespace (e.g., \u003ccode\u003e-U\u003c/code\u003e, \u003ccode\u003e--user\u003c/code\u003e, \u003ccode\u003e-r\u003c/code\u003e, \u003ccode\u003e-rm\u003c/code\u003e, \u003ccode\u003em\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eunshare\u003c/code\u003e command creates a new user namespace context for the process.\u003c/li\u003e\n\u003cli\u003eWithin the newly created namespace, the attacker attempts to change the user ID (UID) to 0 (root).\u003c/li\u003e\n\u003cli\u003eThe system logs a \u003ccode\u003euid_change\u003c/code\u003e event, indicating that the user's UID has been changed to 0 within the namespace.\u003c/li\u003e\n\u003cli\u003eThe attacker executes further commands as root within the new namespace.\u003c/li\u003e\n\u003cli\u003eThese commands may involve exploiting vulnerabilities, modifying system files, or installing malicious software.\u003c/li\u003e\n\u003cli\u003eThe attacker may attempt to escape the namespace to gain root privileges on the host system.\u003c/li\u003e\n\u003cli\u003eThe final objective is to gain persistent root access to the system, allowing for complete control and potential data exfiltration or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to complete system compromise, allowing the attacker to perform any action with root privileges. This can result in data theft, system disruption, or the installation of backdoors for persistent access. The number of victims can vary depending on the scope of the attack, but even a single successful privilege escalation can have severe consequences. Targeted sectors are broad, including any Linux-based system where unprivileged users have access to the \u003ccode\u003eunshare\u003c/code\u003e command, such as cloud workloads and traditional endpoints.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect suspicious \u003ccode\u003eunshare\u003c/code\u003e usage followed by UID changes (\u003ccode\u003ePotential Privilege Escalation via unshare and UID Change\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eInvestigate any detected instances of \u003ccode\u003eunshare\u003c/code\u003e usage with user namespace arguments and subsequent UID changes to root, as described in the rule description.\u003c/li\u003e\n\u003cli\u003eReview and restrict the use of \u003ccode\u003eunshare\u003c/code\u003e and user namespaces if not required in your environment to mitigate the risk of privilege escalation.\u003c/li\u003e\n\u003cli\u003eEnable Elastic Defend integration to collect the necessary process and event data required for the Sigma rule to function effectively (Elastic Defend integration).\u003c/li\u003e\n\u003cli\u003eMonitor process execution for commands run after the \u003ccode\u003euid_change\u003c/code\u003e event to identify potentially malicious activities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T18:23:00Z","date_published":"2024-01-09T18:23:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-09-unshare-privesc/","summary":"This rule detects potential privilege escalation attempts on Linux systems by identifying suspicious use of the `unshare` command to create user namespaces followed by a UID change to root, indicative of local privilege escalation.","title":"Potential Privilege Escalation via unshare and UID Change","url":"https://feed.craftedsignal.io/briefs/2024-01-09-unshare-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Unshare","version":"https://jsonfeed.org/version/1.1"}