Linux process execution of execve_hijack via sudo
Alerts when /sudo spawns a process whose command line includes execve_hijack.
FreeReviewedSigma · High · v2
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-05
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where the command line contains the string "execve_hijack" while the executable path ends with "/sudo". Attackers may use such an execve hijack helper to attempt privilege escalation while blending in with sudo-driven execution. It relies on process creation telemetry, including the parent/command context and the command line content.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-process-creation-execve-hijack-execution-via-sudo-0326c3c8
title: Linux process execution of execve_hijack via sudo
id: f3c5af34-3c4a-4967-922c-4aad991d04c0
status: test
description: This rule flags process creation events where the command line contains the string "execve_hijack" while the executable path ends with "/sudo". Attackers may use such an execve hijack helper to attempt privilege escalation while blending in with sudo-driven execution. It relies on process creation telemetry, including the parent/command context and the command line content.
references:
- https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /sudo
CommandLine|contains: execve_hijack
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e
type: derived