Sigma rule: Privilege Escalation Preparation

Rule

Title

Privilege Escalation Preparation

Status

unsupported

Level

medium

Author

Patrick Bareiss

Date

2019/04/05

Modified

2023/03/24

File

unsupported/linux/lnx_shell_priv_esc_prep.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.

Log source

product

linux

Detection

keywords:
    # distribution type and kernel version
    - 'cat /etc/issue'
    - 'cat /etc/*-release'
    - 'cat /proc/version'
    - 'uname -a'
    - 'uname -mrs'
    - 'rpm -q kernel'
    - 'dmesg | grep Linux'
    - 'ls /boot | grep vmlinuz-'
    # environment variables
    - 'cat /etc/profile'
    - 'cat /etc/bashrc'
    - 'cat ~/.bash_profile'
    - 'cat ~/.bashrc'
    - 'cat ~/.bash_logout'
    # applications and services as root
    - 'ps -aux | grep root'
    - 'ps -ef | grep root'
    # scheduled tasks
    - 'crontab -l'
    - 'cat /etc/cron*'
    - 'cat /etc/cron.allow'
    - 'cat /etc/cron.deny'
    - 'cat /etc/crontab'
    # search for plain text user/passwords
    - 'grep -i user *'
    - 'grep -i pass *'
    # networking
    - 'ifconfig'
    - 'cat /etc/network/interfaces'
    - 'cat /etc/sysconfig/network'
    - 'cat /etc/resolv.conf'
    - 'cat /etc/networks'
    - 'iptables -L'
    - 'ip6tables -L'
    - 'lsof -i'
    - 'netstat -antup'
    - 'netstat -antpx'
    - 'netstat -tulpn'
    - 'arp -e'
    - 'route'
    # sensitive files
    - 'cat /etc/passwd'
    - 'cat /etc/group'
    - 'cat /etc/shadow'
    # sticky bits
    - 'find / -perm -u=s'
    - 'find / -perm -g=s'
    - 'find / -perm -4000'
    - 'find / -perm -2000'
    # world writable files
    - 'find / -perm -o+w'
timeframe: 30m
condition: keywords | count() by host > 6

False positives (as the rule lists them)

• Troubleshooting on Linux Machines

Tags

• attack.execution
• attack.t1059.004

MITRE ATT&CK ids this rule names

• T1059.004

References

• https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
• https://patrick-bareiss.com/detect-privilege-escalation-preparation-in-linux-with-sigma/
• https://github.com/uber-common/metta/blob/master/MITRE/Privilege_Escalation/privesc_linux_filesystemweakness.yml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/linux/lnx_shell_priv_esc_prep.yml