How to identify privilege escalation attempts in Linux logs

Question

I need to monitor Linux logs for signs of privilege escalation attempts but I’m unsure which logs to check and how to interpret them. Specifically, I want to know:

• What log files (/var/log/auth.log, /var/log/secure, etc.) record sudo and su activities?
• How to detect suspicious commands indicating privilege escalation (e.g., exploitation of SUID binaries, kernel exploits)?
• How to set up real-time monitoring or alerts for such attempts using tools like auditd or OSSEC?

A guide on detecting and responding to privilege escalation attempts would be helpful.

Answer 1

Monitoring Linux systems for privilege escalation attempts is crucial for maintaining security and preventing unauthorized access. Here's a comprehensive guide to help you identify and respond to such activities:

1. Key Log Files for Monitoring

• /var/log/auth.log: Records authentication-related events, including sudo and su activities. Commonly found on Debian-based systems like Ubuntu.

• /var/log/secure: Captures security-related messages, including authentication attempts and privilege escalations. Typically present on Red Hat-based systems like CentOS and Fedora.

2. Detecting Suspicious Commands

• SUID Binaries Exploitation: Attackers may exploit misconfigured SUID (Set User ID) binaries to gain elevated privileges. Regularly scan for such binaries using:

  find / -perm -4000 -type f 2>/dev/null 

  Monitor execution of these binaries by setting up audit rules with auditd.

• Kernel Exploits: Unusual activities, such as loading/unloading kernel modules, can indicate exploitation attempts. Monitor /var/log/kern.log and use auditd to track the use of system calls like init_module and delete_module.

3. Setting Up Real-Time Monitoring and Alerts

• auditd (Linux Auditing System):

  • Installation:

    sudo apt install auditd audispd-plugins  # For Debian-based systems
    sudo yum install audit  # For Red Hat-based systems 

  • Configuration: Define rules in /etc/audit/rules.d/audit.rules to monitor specific actions. For example, to log attempts to access the /etc/passwd file:

    -w /etc/passwd -p wa -k passwd_changes 

    This rule watches (-w) the /etc/passwd file for write and attribute changes (-p wa) and tags the events with the key passwd_changes.

  • Starting the Service:

    sudo systemctl start auditd
    sudo systemctl enable auditd 

  • Viewing Logs:

    sudo ausearch -k passwd_changes
    

• OSSEC (Open Source HIDS SECurity):

  • Installation: Follow the official OSSEC installation guide to set up the OSSEC manager and agents on your systems.

  • Configuration: Define rules to detect unauthorized privilege escalations. For instance, to monitor the execution of the pkexec command (associated with certain exploits):

    <group name="privilege_escalation">
      <rule id="100001" level="12">
        <if_sid>1002</if_sid>
        <regex>pkexec</regex>
        <description>Potential pkexec exploitation attempt detected.</description>
        <mitre>
          <id>T1068</id>
        </mitre>
      </rule>
    </group> 

    This rule triggers an alert when the pkexec command is executed, indicating a potential privilege escalation attempt.

  • Active Response: Configure OSSEC to execute predefined actions, such as blocking an IP address or disabling a user account, when specific alerts are triggered.

4. Best Practices for Detecting and Responding to Privilege Escalation Attempts

• Regular Log Review: Consistently monitor and analyze logs from /var/log/auth.log, /var/log/secure, and audit logs to identify unusual activities.

• Implement Principle of Least Privilege: Ensure users have only the permissions necessary for their roles, reducing the risk of unauthorized privilege escalation.

• User Education: Train users on security best practices, emphasizing the importance of safeguarding their credentials and recognizing potential security threats.

• Automated Alerts: Set up automated alerts for suspicious activities, such as multiple failed sudo attempts or changes to critical system files.

• Regular Updates: Keep your system and security tools up to date to protect against known vulnerabilities and exploits.

By implementing these strategies and utilizing tools like auditd and OSSEC, you can effectively monitor for and respond to privilege escalation attempts on your Linux systems.