Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes

Flags Linux processes writing fs.suid_dumpable to enable SUID core dumps, which can expose privileged process memory.

FreeReviewedSigma · Medium · v5

Product: linux
Category: process_creation
Author: Milad Cheraghi (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
- T1003OS Credential Dumping
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies attempts to enable core dumps for SUID processes by changing /proc/sys/fs/suid_dumpable via sysctl calls or shell redirection (echo 1/2). Attackers may use this to capture memory from elevated SUID binaries, potentially exposing sensitive data like passwords, cryptographic keys, or other secrets. It relies on process creation telemetry where the command line shows sysctl usage containing fs.suid_dumpable= or echo of values redirected to /proc/sys/fs/suid_dumpable.

Reporting behind it

Related detections9 linkedT1003 — drag to rearrange

Malicious Wdigest Authentication Enabled - Reg via Command (via process_creation)

Malicious Diskshadow Command Abuse to Expose VSS Backup (via process_creation)

Malicious IIS Application Pool Credential Dumping (via process_creation)

Malicious Wdigest Authentication Enabled - Registry (via registry_set)

Suspicious User Home Directory Modification via dscl Process Creation

Possible GTFOBins Shell Breakout via apt Command

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

Malicious macOS Credential Verification via dscl authonly

Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes

Pivot detection · T1003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-attempts-to-enable-suid-core-dumps-via-proc-sys-fs-suid-dumpable-33b3cfb1

title: "Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes"
id: f1a44d7c-1443-479c-96f6-aa37bd05a9d8
status: experimental
description: This rule identifies attempts to enable core dumps for SUID processes by changing /proc/sys/fs/suid_dumpable via sysctl calls or shell redirection (echo 1/2). Attackers may use this to capture memory from elevated SUID binaries, potentially exposing sensitive data like passwords, cryptographic keys, or other secrets. It relies on process creation telemetry where the command line shows sysctl usage containing fs.suid_dumpable= or echo of values redirected to /proc/sys/fs/suid_dumpable.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-5054
  - https://nvd.nist.gov/vuln/detail/CVE-2025-4598
  - https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE_2025_4598/proc_creation_lnx_exploit_cve_2025_5054_or_cve_2025_4598.yml
author: Milad Cheraghi, Huntrule Team
date: 2026-04-28
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.t1548
  - attack.t1003
  - cve.2025-5054
  - cve.2025-4598
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection_suid_dumpable_sysctl:
    Image|endswith:
      - /sbin/sysctl
      - /bin/sysctl
    CommandLine|contains: fs.suid_dumpable=
  selection_echo_proc_write:
    Image|endswith:
      - /bin/bash
      - /bin/sh
    CommandLine|contains:
      - echo 1 > /proc/sys/fs/suid_dumpable
      - echo 2 > /proc/sys/fs/suid_dumpable
      - echo 1 >/proc/sys/fs/suid_dumpable
      - echo 2 >/proc/sys/fs/suid_dumpable
      - echo 1> /proc/sys/fs/suid_dumpable
      - echo 2> /proc/sys/fs/suid_dumpable
      - echo 1>/proc/sys/fs/suid_dumpable
      - echo 2>/proc/sys/fs/suid_dumpable
  condition: 1 of selection_*
falsepositives:
  - System administrators enabling debugging temporarily
  - Legitimate crash diagnostic operations
level: medium
license: DRL-1.1
related:
  - id: 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL