Linux auth logs keyword match for PwnKit (CVE-2021-4034) pkexec exploitation indicators

Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.

FreeUnreviewedSigmahighv1

linux-auth-logs-keyword-match-for-pwnkit-cve-2021-4034-pkexec-exploitation-indic-0506a799

title: Linux auth logs keyword match for PwnKit (CVE-2021-4034) pkexec exploitation indicators
id: ec196bce-77df-4b02-8caa-c036498b903b
status: test
description: This rule flags Linux authentication-log entries containing keywords associated with PwnKit exploitation attempts, including the presence of "pkexec" and specific environment and session strings. Attackers may leverage these conditions to trigger a local privilege escalation path, so correlating these signals helps surface suspicious activity during authentication. It relies on auth log telemetry containing the listed keyword phrases.
references:
  - https://twitter.com/wdormann/status/1486161836961579020
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml
author: Sreeman, Huntrule Team
date: 2022-01-26
modified: 2024-09-11
tags:
  - attack.privilege-escalation
  - attack.t1548.001
  - detection.emerging-threats
  - cve.2021-4034
logsource:
  product: linux
  service: auth
detection:
  keywords:
    "|all":
      - pkexec
      - The value for environment variable XAUTHORITY contains suspicious content
      - "[USER=root] [TTY=/dev/pts/0]"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0506a799-698b-43b4-85a1-ac4c84c720e9
    type: derived

What it detects

This rule flags Linux authentication-log entries containing keywords associated with PwnKit exploitation attempts, including the presence of "pkexec" and specific environment and session strings. Attackers may leverage these conditions to trigger a local privilege escalation path, so correlating these signals helps surface suspicious activity during authentication. It relies on auth log telemetry containing the listed keyword phrases.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.