Local privilege escalation can transform limited access into full control of a Linux system. Instead of relying only on a specific exploit signature, defenders can hunt for execution behavior that indicates a normal user context has reached root-level execution.
The source defines a Linux audit query for this scenario.
Coverage includes CVE-2025-32463, CVE-2025-38352, CVE-2026-31431, and other local elevation-of-privilege flaws.
Detection Logic
The query requires:
effective user ID
0, representing root;original audit user ID matching selected non-root users;
shell or interpreter execution, or a working directory under a temporary or web-accessible location.
Detection Query
rule.groups:audit and data.audit.euid:0 and data.audit.auid:("1000" or "1001" or "1002") and (data.audit.exe: (/bin/sh or /bin/bash or /usr/bin/dash or /usr/bin/python or /usr/bin/python3 or /usr/bin/perl) or data.audit.cwd: (/tmp* or /var/tmp* or /dev/shm* or */public_html*))The source recorded zero results during the previous 30 days.
Why the User Context Matters
Root-level processes are normal on Linux systems. The important part is the relationship between effective root privileges and the original user context.
A standard user account that suddenly produces a root shell from /tmp or /dev/shm is more interesting than a known system service running as root from its normal location.
Investigation Workflow
If a match appears, review:
original audit user;
effective user;
executable;
parent process;
current working directory;
command line;
sudo activity;
file creation immediately before execution;
authentication history.
Determine whether the elevation was an approved administrative action or unexpected privilege change.
Tuning
The source query lists audit user IDs 1000, 1001, and 1002. In production, these values should be adapted to the local environment.
Known administrator workflows using sudo may need explicit baselines, especially if they legitimately execute shells.
Correlation
A privilege-escalation event should be correlated with:
web application execution;
suspicious downloaded files;
persistence;
SSH key changes;
reverse shells;
defense evasion.
A chain from low-privilege application access to root execution provides substantially stronger evidence.
Operational Value
The source recorded no matches, making this a low-volume behavioral hunt.
By combining user identity, effective privilege, executable type, and working directory, the query provides a practical way to identify suspicious root execution across several possible local EoP techniques.
