Linux: Process attempts to enable SUID core dumps via /proc/sys/fs/suid_dumpable

Flags Linux processes writing fs.suid_dumpable to enable SUID core dumps, which can expose privileged process memory.

FreeUnreviewedSigmamediumv1

linux-process-attempts-to-enable-suid-core-dumps-via-proc-sys-fs-suid-dumpable-33b3cfb1

title: "Linux: Process attempts to enable SUID core dumps via /proc/sys/fs/suid_dumpable"
id: f1a44d7c-1443-479c-96f6-aa37bd05a9d8
status: experimental
description: This rule flags Linux process activity that attempts to enable core dumps for set-user-ID (SUID) binaries by writing to /proc/sys/fs/suid_dumpable (commonly setting the value to 1 or 2). Attackers use this to capture memory from SUID processes that typically run with elevated privileges, potentially exposing sensitive secrets such as passwords or cryptographic keys. Detection relies on process creation telemetry showing sysctl usage and shell commands that echo new values to the sysctl path.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-5054
  - https://nvd.nist.gov/vuln/detail/CVE-2025-4598
  - https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE_2025_4598/proc_creation_lnx_exploit_cve_2025_5054_or_cve_2025_4598.yml
author: Milad Cheraghi, Huntrule Team
date: 2026-04-28
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.t1548
  - attack.t1003
  - cve.2025-5054
  - cve.2025-4598
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection_suid_dumpable_sysctl:
    Image|endswith:
      - /sbin/sysctl
      - /bin/sysctl
    CommandLine|contains: fs.suid_dumpable=
  selection_echo_proc_write:
    Image|endswith:
      - /bin/bash
      - /bin/sh
    CommandLine|contains:
      - echo 1 > /proc/sys/fs/suid_dumpable
      - echo 2 > /proc/sys/fs/suid_dumpable
      - echo 1 >/proc/sys/fs/suid_dumpable
      - echo 2 >/proc/sys/fs/suid_dumpable
      - echo 1> /proc/sys/fs/suid_dumpable
      - echo 2> /proc/sys/fs/suid_dumpable
      - echo 1>/proc/sys/fs/suid_dumpable
      - echo 2>/proc/sys/fs/suid_dumpable
  condition: 1 of selection_*
falsepositives:
  - System administrators enabling debugging temporarily
  - Legitimate crash diagnostic operations
level: medium
license: DRL-1.1
related:
  - id: 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
    type: derived

What it detects

This rule flags Linux process activity that attempts to enable core dumps for set-user-ID (SUID) binaries by writing to /proc/sys/fs/suid_dumpable (commonly setting the value to 1 or 2). Attackers use this to capture memory from SUID processes that typically run with elevated privileges, potentially exposing sensitive secrets such as passwords or cryptographic keys. Detection relies on process creation telemetry showing sysctl usage and shell commands that echo new values to the sysctl path.

Known false positives

System administrators enabling debugging temporarily
Legitimate crash diagnostic operations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.