Linux Binary Launched Process with Null Argv
Description
The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
Query · spl
`linux_syslog` "NULL argv" "empty string added"
| rex field=_raw "process '(?<launching_process>[^']+)' launched '(?<launched_process>[^']+)' with NULL argv"
| where isnotnull(launching_process) AND isnotnull(launched_process)
| stats
count AS occurrences,
min(_time) AS firstTime,
max(_time) AS lastTime,
values(_raw) AS message,
values(host) AS dest
by host, launching_process, launched_process
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table dest, launching_process, launched_process,
firstTime, lastTime, occurrences, message
| `linux_binary_launched_process_with_null_argv_filter`
Implementation guide
To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
Known false positives
- Legitimate false positives are rare but can occur when custom or poorly written setuid binaries, PAM modules, or login frameworks invoke shells programmatically without constructing a proper argv array. However, mainstream setuid binaries like su, sudo, and pkexec on modern Linux distributions always pass arguments, so any hit involving those specific processes should be treated as high confidence.
Analyst notes
Known false positives: Legitimate false positives are rare but can occur when custom or poorly written setuid binaries, PAM modules, or login frameworks invoke shells programmatically without constructing a proper argv array. However, mainstream setuid binaries like su, sudo, and pkexec on modern Linux distributions always pass arguments, so any hit involving those specific processes should be treated as high confidence.