Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt

Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.

FreeReviewedSigma · High · v5
Product
linux
Service
auth
Author
Sreeman (SigmaHQ), DRL 1.1
Published
2022-01-26
Updated
2026-07-31
title: "Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt"
id: ec196bce-77df-4b02-8caa-c036498b903b
status: test
description: This rule flags Linux authentication log entries containing specific pkexec-related and XAUTHORITY-related strings that may indicate a PwnKit (CVE-2021-4034) local privilege escalation attempt. Attackers can use pkexec with manipulated environment variables to escalate privileges, so these distinctive log patterns are valuable for early triage. The detection relies on keyword matches in auth log text, including a suspicious XAUTHORITY message and a root/TTY pattern.
references:
  - https://twitter.com/wdormann/status/1486161836961579020
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml
author: Sreeman, Huntrule Team
date: 2022-01-26
modified: 2024-09-11
tags:
  - attack.privilege-escalation
  - attack.t1548.001
  - detection.emerging-threats
  - cve.2021-4034
logsource:
  product: linux
  service: auth
detection:
  keywords:
    "|all":
      - pkexec
      - The value for environment variable XAUTHORITY contains suspicious content
      - "[USER=root] [TTY=/dev/pts/0]"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0506a799-698b-43b4-85a1-ac4c84c720e9
    type: derived