Techniques
Sample rules
Linux Root Execution of id
- source: splunk
- technicques:
Description
The following analytic detects the execution of the id command by the root user on Linux systems. Attackers commonly run id during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt.
This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise.
If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.process_path="/usr/bin/id"
Processes.user="root"
by Processes.process Processes.vendor_product Processes.user_id
Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
Processes.action Processes.dest Processes.process_current_directory Processes.process_path
Processes.process_integrity_level Processes.original_file_name Processes.parent_process
Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
Processes.process_guid Processes.process_id Processes.user Processes.process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_root_execution_of_id_filter`