# Privilege Escalation Attempt

- **Severity:** High
- **Signature ID:** `ecc81ba6-4c08-5171-845b-e65daf432843`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI07 (Unsafe Autonomous Code Execution)

## Summary

This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities to a binary. These are standard steps attackers take after getting a foothold on a machine, to turn limited access into full control.

## How the attack works

An attacker who has gained a low-privilege shell on a system looks for ways to become root. They may invoke sudo directly if misconfigured permissions allow it, set the setuid bit on a binary so it always runs as its owner (often root), change a file's ownership to root so they can execute it with elevated rights, or assign Linux capabilities (like CAP_SETUID) to a program to grant it root-like powers without full root. Any of these steps can let a normal user execute code with root privileges going forward.

## Why it matters

If successful, the attacker gains root access, meaning they can read and modify any file, install persistent malware, disable security tools, and move further into the environment.

## What you can do

- Review sudoers configuration regularly and restrict NOPASSWD entries to the minimum needed.
- Audit binaries with the setuid bit or unusual Linux capabilities set, especially outside of package manager updates.
- Alert on ownership changes to root for files outside of expected deployment or build processes.
- Whitelist known deployment and build scripts that legitimately set permissions, so they don't drown out real alerts.

## Known benign look-alikes

- Legitimate use of sudo for package installation or system configuration
- Build scripts that set file permissions as part of deployment

## References

- https://attack.mitre.org/techniques/T1548/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/privilege-escalation