Privilege Escalation Attempt

How the attack works

An attacker who has gained a low-privilege shell on a system looks for ways to become root. They may invoke sudo directly if misconfigured permissions allow it, set the setuid bit on a binary so it always runs as its owner (often root), change a file's ownership to root so they can execute it with elevated rights, or assign Linux capabilities (like CAP_SETUID) to a program to grant it root-like powers without full root. Any of these steps can let a normal user execute code with root privileges going forward.

Netzilo detection

Why it matters

If successful, the attacker gains root access, meaning they can read and modify any file, install persistent malware, disable security tools, and move further into the environment.

What you can do

• →Review sudoers configuration regularly and restrict NOPASSWD entries to the minimum needed.
• →Audit binaries with the setuid bit or unusual Linux capabilities set, especially outside of package manager updates.
• →Alert on ownership changes to root for files outside of expected deployment or build processes.
• →Whitelist known deployment and build scripts that legitimately set permissions, so they don't drown out real alerts.

Known benign look-alikes

• Legitimate use of sudo for package installation or system configuration
• Build scripts that set file permissions as part of deployment

References

• https://attack.mitre.org/techniques/T1548/
• https://arxiv.org/abs/2403.04783

Related threats