Linux Process Creation: execve_hijack Execution via /sudo

Alerts when /sudo spawns a process whose command line includes execve_hijack.

FreeUnreviewedSigmahighv1

linux-process-creation-execve-hijack-execution-via-sudo-0326c3c8

title: "Linux Process Creation: execve_hijack Execution via /sudo"
id: f3c5af34-3c4a-4967-922c-4aad991d04c0
status: test
description: This rule flags process creation events where the parent process path ends with '/sudo' and the command line contains 'execve_hijack'. The matched binary name is associated with the Triple Cross eBPF rootkit mechanism used to facilitate privilege escalation. Telemetry relies on Linux process creation fields, specifically the executable image path and the full command line.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains: execve_hijack
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e
    type: derived

What it detects

This rule flags process creation events where the parent process path ends with '/sudo' and the command line contains 'execve_hijack'. The matched binary name is associated with the Triple Cross eBPF rootkit mechanism used to facilitate privilege escalation. Telemetry relies on Linux process creation fields, specifically the executable image path and the full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.