---
title: Suspicious SUID Binary Execution (Auditd Sequence)
description: Detects suspicious sequences where a non-root user launches a high-risk parent process (interpreter, shell one-liner, or execution from user-writable...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution_auditd_sequence
products:
  - Elastic Security
---

# Suspicious SUID Binary Execution (Auditd Sequence)
Detects suspicious sequences where a non-root user launches a high-risk parent process (interpreter, shell one-liner, or
execution from user-writable paths) and then quickly executes a common privilege elevation helper (su, sudo, pkexec,
passwd, chsh, newgrp) that gains an effective UID of 0 while the real UID remains non-root. This can indicate misuse of
SUID/SGID helpers, polkit/sudo abuse, or interactive privilege escalation attempts captured via Auditd Manager telemetry.
**Rule type**: eql
**Rule indices**:
- auditbeat-*
- logs-auditd_manager.auditd-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://attack.mitre.org/techniques/T1548/](https://attack.mitre.org/techniques/T1548/)](https://attack.mitre.org/techniques/T1548/)
- [[https://docs.elastic.co/integrations/auditd_manager](https://docs.elastic.co/integrations/auditd_manager)](https://docs.elastic.co/integrations/auditd_manager)

**Tags**:
- Data Source: Auditd Manager
- Domain: Endpoint
- OS: Linux
- Use Case: Threat Detection
- Tactic: Privilege Escalation
- Resources: Investigation Guide
- Noise: Medium
- Performance: Normal
- Rule Type: Event Correlation (EQL)
- Platform: Linux

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating Suspicious SUID Binary Execution (Auditd Sequence)

Confirm whether the non-root real user should be invoking su, sudo, pkexec, or account utilities as root. Review the
parent process chain and whether the parent executable location or shell invocation suggests a one-liner or staging
from user-writable paths.

### Possible investigation steps

- Review process details for script paths, temp directory execution, or suspicious interpreters.
- Check sudoers / polkit policy changes and recent authentication events for the user.
- Pivot for follow-on persistence (cron, systemd units) or credential access from the same session.


### Response and remediation

- If unauthorized, contain the session, revoke elevated access, and review sudoers and polkit configuration for tampering.


## Rule Query

```eql
sequence by host.id with maxspan=30s
  [process where host.os.type == "linux" and event.type == "start" and
   event.action == "executed" and
   user.id != "0" and user.effective.id != "0" and
   (
     process.name like ("python*", "perl*", "ruby*", "php*", "lua*", ".*") or
     process.name in ("node", "bun", "java") or
     process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
     (
       process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
       process.args in ("-c", "--command", "-ic", "-ci", "-cl", "-lc")
     )
   )
  ] by process.pid

  [process where host.os.type == "linux" and event.type == "start" and
   event.action == "executed" and
   user.effective.id == "0" and user.id != "0" and
   (
     (process.name in ("sudo", "pkexec") and
      not process.args like "-*" and
      not process.args : ("/usr/*", "/bin/*", "/sbin/*", "/opt/*")) or
     (process.name == "su" and
      not process.args in ("--command", "-c", "--shell", "-s")) or
     (process.name in ("passwd", "chsh", "newgrp") and
      not process.args in ("--shell", "-s", "--help"))
   )
  ] by process.parent.pid
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Abuse Elevation Control Mechanism
  - Id: T1548
  - Reference URL: [[https://attack.mitre.org/techniques/T1548/](https://attack.mitre.org/techniques/T1548/)](https://attack.mitre.org/techniques/T1548/)
- Sub Technique:
  - Name: Setuid and Setgid
  - Id: T1548.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1548/001/](https://attack.mitre.org/techniques/T1548/001/)](https://attack.mitre.org/techniques/T1548/001/)
- Sub Technique:
  - Name: Sudo and Sudo Caching
  - Id: T1548.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1548/003/](https://attack.mitre.org/techniques/T1548/003/)](https://attack.mitre.org/techniques/T1548/003/)