developers or system administrators may stage alternate system files for legitimate testing or containerized environments. filter based on known development or testing systems.

splunk

Techniques

Sample rules

Linux Suspicious Staging of Alternate System Files

source: splunk
technicques:

Description

The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime max(_time) as lastTime

FROM datamodel=Endpoint.Filesystem WHERE

Filesystem.file_path IN (
    "*/etc/group",
    "*/etc/nsswitch.conf",
    "*/etc/pam.conf",
    "*/etc/passwd",
    "*/etc/shadow",
    "*/etc/sudo.conf",
    "*/etc/sudoers",
    "*/libnss_*"
)
NOT Filesystem.file_path IN (
    "/etc/*",
    "/var/lib/docker/*"
)

BY Filesystem.action Filesystem.dest Filesystem.file_access_time
   Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
   Filesystem.file_name Filesystem.file_path Filesystem.process_guid
   Filesystem.process_id Filesystem.user Filesystem.vendor_product


| `drop_dm_object_name(Filesystem)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `linux_suspicious_staging_of_alternate_system_files_filter`