[Meta] Linux Privilege Escalation Research & Detection Engineering

[Aegrah]

Summary

Analyze commonly exploited linux privilege escalation vectors, research the methodology required to exploit those vectors and analyze whether we can detect these vectors, and if not, create detection rules to cover our detection gaps.

### Tasks
- [x] Identify a set of linux privilege escalation vectors that we currently have no coverage for (week 1-2)
- [x] Exploit and research these privilege escalation vectors (week 1-2)
- [x] Write DRs for these coverage gaps (week 1-2)
- [x] Get PRs merged

Goals

• Identify a set of linux privilege escalation vectors that we currently do not detect.
• Identify whether we can create detection rules for these vectors, and if so, create these DRs.
• DRs with little to no FPs will be (or will be in the future) converted to ERs.

Resources:

https://www.rgrosec.com/post/2022-02-17-linux-privilege-escalation.html
https://book.hacktricks.xyz/linux-hardening/privilege-escalation
https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
https://github.com/rebootuser/LinEnum

PRs

• [New Rule] Sudo Command Enumeration Detected #2946
• [New Rule] Pspy Process Monitoring Detected #2945
• [New Rule] SUID/SGUID Enumeration Detected #2956
• [New Rule] Potential Sudo Hijacking Detected #2966
• [New Rule] Suspicious Symbolic Link Created #2969
• [New BBR] Suspicious Clipboard Activity #2970
• [New Rule] Linux Local Account Brute Force #2965
• [New BBR] Potential Suspicious File Edit #2960
• [New Rule] PE through Writable Docker Socket #2958
• [New BBR] Suspicious Clipboard Activity #2970
• [New Rule] PE via UID INT_MAX Bug #2971
• [New Rules] Linux Wildcard Injection #2973
• [New Rule] Potential Privilege Escalation via OverlayFS #2974
• https://github.com/elastic/endpoint-rules/pull/2587
• [New Rule] Potential Suspicious DebugFS Root Device Access #2982
• [New Rule] PE via Container Misconfiguration #2983
• [New Rule] Potential Sudo Token Manipulation via Process Injection #2984

[brokensound77]

Just did a review of all pending rules 👍, great job