Potential Local Privilege Escalation via Environment Variables Misuse

Description

Process run with suspect environment variable that could be attempting privilege escalation. One use case is detecting the use of the GLIBC_TUNABLES environment variable, which could be used for privilege escalation on systems running vulnerable glibc versions. Only known and carefully profiled processes that legitimately exhibit this behavior should be excluded from this rule. This rule is expected to trigger on every attempt, even failed ones.

Query · falco

spawned_process and glibc_tunables_env

Rule dependencies

Depends on

  • composes · Falco macro glibc_tunables_env
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Process run with suspect environment variable which could be attempting privilege escalation | env=%proc.env evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Potential Local Privilege Escalation via Environment Variables Misuse · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Potential Local Privilege Escalation via Environment Variables Misuse
desc: 'Process run with suspect environment variable that could be attempting privilege
  escalation. One use case is detecting the use of the GLIBC_TUNABLES environment
  variable, which could be used for privilege escalation on systems running vulnerable
  glibc versions. Only known and carefully profiled processes that legitimately exhibit
  this behavior should be excluded from this rule. This rule is expected to trigger
  on every attempt, even failed ones.

  '
condition: 'spawned_process and glibc_tunables_env

  '
enabled: true
output: Process run with suspect environment variable which could be attempting privilege
  escalation | env=%proc.env evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- users
- mitre_privilege_escalation
- TA0004

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.