Techniques
Sample rules
Linux Possible Privilege Escalation via PYTHONPATH
- source: splunk
- technicques:
Description
The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation. Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/init.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process, such as NeedRestart running as root, loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges. The detection monitors for file writes matching the importlib/init.so pattern that do not originate from expected system library paths.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Filesystem where
Filesystem.file_path="*/importlib/__init__.so*"
NOT Filesystem.file_path IN (
"/lib/*",
"/lib64/*",
"/usr/lib/*",
"/usr/lib64/*",
"/usr/local/lib/*",
"/usr/local/lib64/*"
)
by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
Filesystem.process_guid Filesystem.process_id
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_possible_privilege_escalation_via_pythonpath_filter`