huntrule

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Alerts on Linux process command lines containing ' -u#' indicative of sudo CVE-2019-14287 exploitation attempts.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-10-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where the command line contains the specific argument pattern ' -u#', consistent with attempts to exploit the sudo vulnerability associated with CVE-2019-14287. Attackers may use malformed or crafted sudo parameters to attempt privilege escalation to higher-privileged execution. The detection relies on Linux process creation telemetry that includes command-line arguments for newly spawned processes.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange
Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)
Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings
Suspicious Modification of Privileged Authentication Binaries via Kernel LPE
Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)
Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)
Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)
Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)
Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)
Possible noPac sAMAccountName Spoofing via Machine Account Rename
Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern
Pivot detection · T1068 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.