[New Rule] Potential Sudo Token Manipulation via Process Injection

[Aegrah]

Summary

This rule detects potential sudo token manipulation attacks through process injection by monitoring the use of a debugger (gdb) process followed by a successful uid change event during the execution of the sudo process. A sudo token manipulation attack is performed by injecting into a process that has a valid sudo token, which can then be used by attackers to activate their own sudo token. This attack requires ptrace to be enabled in conjunction with the existence of a living process that has a valid sudo token with the same uid as the current user.

Detection

0 hits in RedSector for this behavior during the last 365 days.

sequence by host.id, process.session_leader.entity_id with maxspan=15s
[ process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
  process.name == "gdb" and process.user.id != "0" and process.group.id != "0" ]
[ process where host.os.type == "linux" and event.action == "uid_change" and event.type == "change" and 
  process.name == "sudo" and process.user.id == "0" and process.group.id == "0" ]

[DefSecSentinel]

LGTM

[eric-forte-elastic]

Very nice! 👍