Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt

Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.

FreeReviewedSigma · High · v5

Product: linux
Service: auth
Author: Sreeman (SigmaHQ), DRL 1.1
Published: 2022-01-26
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.001Setuid and Setgid
Defense Evasion
- T1548.001Setuid and Setgid
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux authentication log entries containing specific pkexec-related and XAUTHORITY-related strings that may indicate a PwnKit (CVE-2021-4034) local privilege escalation attempt. Attackers can use pkexec with manipulated environment variables to escalate privileges, so these distinctive log patterns are valuable for early triage. The detection relies on keyword matches in auth log text, including a suspicious XAUTHORITY message and a root/TTY pattern.

Reporting behind it

Related detections3 linkedT1548.001 — drag to rearrange

Possible CopyFail Root Exploitation via Python Spawning SUID Shell (via process_creation)

Suspicious User and Network Namespace Creation via unshare on Linux

Linux process activity: chown root and setuid/setgid chmod flags

Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt

Pivot detection · T1548.001 · 3 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auth-logs-keyword-match-for-pwnkit-cve-2021-4034-pkexec-exploitation-indic-0506a799

title: "Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt"
id: ec196bce-77df-4b02-8caa-c036498b903b
status: test
description: This rule flags Linux authentication log entries containing specific pkexec-related and XAUTHORITY-related strings that may indicate a PwnKit (CVE-2021-4034) local privilege escalation attempt. Attackers can use pkexec with manipulated environment variables to escalate privileges, so these distinctive log patterns are valuable for early triage. The detection relies on keyword matches in auth log text, including a suspicious XAUTHORITY message and a root/TTY pattern.
references:
  - https://twitter.com/wdormann/status/1486161836961579020
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml
author: Sreeman, Huntrule Team
date: 2022-01-26
modified: 2024-09-11
tags:
  - attack.privilege-escalation
  - attack.t1548.001
  - detection.emerging-threats
  - cve.2021-4034
logsource:
  product: linux
  service: auth
detection:
  keywords:
    "|all":
      - pkexec
      - The value for environment variable XAUTHORITY contains suspicious content
      - "[USER=root] [TTY=/dev/pts/0]"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0506a799-698b-43b4-85a1-ac4c84c720e9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL