Linux sudo --chroot Command Execution

Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.

FreeUnreviewedSigmalowv1

linux-sudo-chroot-command-execution-f2bed782

title: Linux sudo --chroot Command Execution
id: 3423febc-1ac3-4d5b-bf88-c73c69671453
status: experimental
description: This rule flags process executions where the command line contains sudo-specific chroot usage, including " --chroot " and "sudo -R ". Attackers can use this to run commands in an alternate root filesystem, potentially helping them bypass monitoring or perform actions within a manipulated environment. It relies on Linux process creation telemetry capturing the executable path ending in /sudo and the full command line arguments.
references:
  - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml
author: Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule Team
date: 2025-10-02
tags:
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains:
      - " --chroot "
      - "sudo -R "
  condition: selection
falsepositives:
  - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.
level: low
license: DRL-1.1
related:
  - id: f2bed782-994e-4f40-9cd5-518198cb3fba
    type: derived

What it detects

This rule flags process executions where the command line contains sudo-specific chroot usage, including " --chroot " and "sudo -R ". Attackers can use this to run commands in an alternate root filesystem, potentially helping them bypass monitoring or perform actions within a manipulated environment. It relies on Linux process creation telemetry capturing the executable path ending in /sudo and the full command line arguments.

Known false positives

Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.