Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt
Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.
- Product
- linux
- Service
- auth
- Author
- Sreeman (SigmaHQ), DRL 1.1
- Published
- 2022-01-26
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux authentication log entries containing specific pkexec-related and XAUTHORITY-related strings that may indicate a PwnKit (CVE-2021-4034) local privilege escalation attempt. Attackers can use pkexec with manipulated environment variables to escalate privileges, so these distinctive log patterns are valuable for early triage. The detection relies on keyword matches in auth log text, including a suspicious XAUTHORITY message and a root/TTY pattern.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt"
id: ec196bce-77df-4b02-8caa-c036498b903b
status: test
description: This rule flags Linux authentication log entries containing specific pkexec-related and XAUTHORITY-related strings that may indicate a PwnKit (CVE-2021-4034) local privilege escalation attempt. Attackers can use pkexec with manipulated environment variables to escalate privileges, so these distinctive log patterns are valuable for early triage. The detection relies on keyword matches in auth log text, including a suspicious XAUTHORITY message and a root/TTY pattern.
references:
- https://twitter.com/wdormann/status/1486161836961579020
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml
author: Sreeman, Huntrule Team
date: 2022-01-26
modified: 2024-09-11
tags:
- attack.privilege-escalation
- attack.t1548.001
- detection.emerging-threats
- cve.2021-4034
logsource:
product: linux
service: auth
detection:
keywords:
"|all":
- pkexec
- The value for environment variable XAUTHORITY contains suspicious content
- "[USER=root] [TTY=/dev/pts/0]"
condition: keywords
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0506a799-698b-43b4-85a1-ac4c84c720e9
type: derived