[Rule Tuning] Enhance privilege_escalation_cve_2025_32463_sudo_chroot_execution detection

[1r0dm480]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml

Rule Tuning Type

None

Description

Summary

The existing rule Potential CVE-2025-32463 Sudo Chroot Execution Attempt detects sudo executions using --chroot / -R potentially exploiting CVE-2025-32463.
While effective, it could be improved to reduce false positives and enhance coverage for real attacker patterns.

---

Proposed Improvements

• Argument Matching: Use regex on process.command_line to match variations of --chroot / -R, including --chroot=/tmp/... and -R=/home/user/....
• Suspicious Path Detection: Focus on chroot targets in typical attacker-controlled locations (/tmp, /var/tmp, ~/, /home/*).
• Parent Whitelist: Exclude common legitimate parents (systemd, init, cron, package managers, CI/build scripts) to reduce noise.
• ECS Fields: Include process.parent.executable, process.command_line, user.name, and host.name for richer context.
• Tests: Add automated positive and negative events to validate CI coverage and prevent regressions.

---

References

• CVE-2025-32463 on GitHub
• Stratascale Advisory
• Elastic Security Documentation

---

Suggested Actions

• Review the rule and enhance the query for argument flexibility and path heuristics.
• Add a parent whitelist and include positive/negative JSON test events for CI.
• Update the rule documentation and investigation notes.

---

Expected Outcome

• Improved detection coverage for CVE-2025-32463 exploitation attempts.
• Reduced false positives in environments with legitimate sudo chroot usage.
• CI tests validate correctness and prevent regressions.

---

Checklist

• Update query to include flexible argument

Example Data

New PR tunning

[metadata]
id = "0a2f7c2c-91dd-4a36-8cc1-cve202532463"
name = "Potential CVE-2025-32463 Sudo Chroot Execution Attempt (Enhanced)"
description = """
Detects potential exploitation attempts of CVE-2025-32463, a vulnerability in sudo that allows
privilege escalation through improper use of the --chroot (-R) option. This version enhances
argument detection, adds path heuristics, and reduces false positives by whitelisting legitimate
parent processes.
"""
version = 2
author = ["Elastic", "community/ivanr"]
date = "2025-10-15"
tags = ["Elastic", "Linux", "Privilege Escalation", "CVE-2025-32463", "sudo", "chroot", "community enhancement"]
status = "experimental"

[rule]
type = "eql"
query = '''
process
where event.action == "executed"
and process.name == "sudo"
and (
process.args like "--chroot%" or
process.args like "-R%" or
process.command_line regex ".(--chroot|-R)[ =]?(/tmp|/var/tmp|/home/|/mnt|/srv)."
)
and not process.parent.name in (
"systemd",
"cron",
"bash",
"zsh",
"apt-get",
"dpkg",
"yum",
"ansible-playbook",
"salt-minion"
)
'''

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique.subtechnique]]
id = "T1068.001"
name = "Sudo Chroot Exploitation"
reference = "https://attack.mitre.org/techniques/T1068/001/"

[[threat.tactic]]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[setup]
interval = "5m"
max_signals = 100
from = "now-5m"

[references]
urls = [
"https://github.com/kh4sh3i/CVE-2025-32463",
"https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot",
"https://ubuntu.com/security/CVE-2025-32463",
"https://www.elastic.co/guide/en/security/current/index.html"
]

[tests]

[[tests.positive_test]]
name = "Sudo Chroot Exploitation Attempt"
event = '''
{
"@timestamp": "2025-10-15T11:32:18.000Z",
"event": { "action": "executed", "category": "process", "type": "start" },
"process": {
"name": "sudo",
"pid": 1342,
"command_line": "sudo --chroot /tmp/rootfs /bin/bash",
"args": ["sudo", "--chroot", "/tmp/rootfs", "/bin/bash"],
"executable": "/usr/bin/sudo",
"parent": { "pid": 1221, "name": "bash", "executable": "/usr/bin/bash" }
},
"user": { "id": "1000", "name": "analyst" },
"host": { "hostname": "ubuntu-lab", "os": { "name": "Ubuntu", "version": "22.04", "type": "linux" } }
}
'''

[[tests.negative_test]]
name = "Legitimate Sudo Chroot Used by Systemd"
event = '''
{
"@timestamp": "2025-10-15T09:15:00.000Z",
"event": { "action": "executed", "category": "process", "type": "start" },
"process": {
"name": "sudo",
"pid": 2012,
"command_line": "sudo --chroot /srv/systemd-chroot /bin/bash",
"args": ["sudo", "--chroot", "/srv/systemd-chroot", "/bin/bash"],
"executable": "/usr/bin/sudo",
"parent": { "pid": 1, "name": "systemd", "executable": "/usr/lib/systemd/systemd" }
},
"user": { "id": "0", "name": "root" },
"host": { "hostname": "debian-prod", "os": { "name": "Debian", "version": "12", "type": "linux" } }
}
'''

[setup.logging]
enabled = true

Example Data

{
  "@timestamp": "2025-10-15T11:32:18.000Z",
  "event": {
    "action": "executed",
    "category": "process",
    "type": "start"
  },
  "process": {
    "name": "sudo",
    "pid": 1342,
    "command_line": "sudo --chroot /tmp/rootfs /bin/bash",
    "executable": "/usr/bin/sudo",
    "args": ["sudo", "--chroot", "/tmp/rootfs", "/bin/bash"],
    "parent": {
      "pid": 1221,
      "name": "bash",
      "executable": "/usr/bin/bash"
    }
  },
  "user": {
    "id": "1000",
    "name": "analyst"
  },
  "host": {
    "hostname": "ubuntu-lab",
    "os": {
      "name": "Ubuntu",
      "type": "linux",
      "version": "22.04"
    }
  },
  "agent": {
    "type": "auditd",
    "version": "8.14.0"
  }
}

[Aegrah]

Thanks for bringing up the fact that chroot has the option to specify a path using --chroot=directory in vulnerable sudo versions. However, next time (before creating the issue), please double-check whether the LLM-generated content is correct. For example, you provide an EQL query with % as regex pattern (which is not how EQL works), and a regex that is not supported by EQL.

I added the tuning for the false negatives in #5227.

Cheers!