Non sudo setuid

Description

Detect attempts to change users through the use of setuid, with exceptions for sudo/su. The users "root" and "nobody" using setuid on themselves are also excluded, as setuid calls in these cases typically involve reducing privileges. By setting the setuid bit, an attacker could execute code in a different user's context, potentially with higher privileges. One drawback is the potential for noise, as many applications legitimately use this approach.

Query · falco

evt.type=setuid and (known_user_in_container or not container) and not (user.name=root or user.uid=0) and not somebody_becoming_themselves and not proc.name in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,
                      nomachine_binaries)
and not proc.name startswith "runc:" and not java_running_sdjagent and not nrpe_becoming_nagios and not user_known_non_sudo_setuid_conditions

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro java_running_sdjagent
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro known_user_in_container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro nrpe_becoming_nagios
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro somebody_becoming_themselves
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_non_sudo_setuid_conditions
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Unexpected setuid call by non-sudo, non-root program | arg_uid=%evt.arg.uid evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Non sudo setuid · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Non sudo setuid
desc: 'Detect attempts to change users through the use of setuid, with exceptions
  for sudo/su. The users "root" and "nobody" using setuid on themselves are also excluded,
  as setuid calls in these cases typically involve reducing privileges. By setting
  the setuid bit, an attacker could execute code in a different user''s context, potentially
  with higher privileges. One drawback is the potential for noise, as many applications
  legitimately use this approach.

  '
condition: "evt.type=setuid and (known_user_in_container or not container) and not\
  \ (user.name=root or user.uid=0) and not somebody_becoming_themselves and not proc.name\
  \ in (known_setuid_binaries, userexec_binaries, mail_binaries, docker_binaries,\n\
  \                      nomachine_binaries)\nand not proc.name startswith \"runc:\"\
  \ and not java_running_sdjagent and not nrpe_becoming_nagios and not user_known_non_sudo_setuid_conditions\n"
output: Unexpected setuid call by non-sudo, non-root program | arg_uid=%evt.arg.uid
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- users
- mitre_privilege_escalation
- T1548.001

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.