Potential Privilege Escalation via unshare and UID Change

Last updated 4 days ago on 2026-05-08

Created 3 years ago on 2023-07-28

About

Identifies potentially suspicious use of unshare to create a user namespace context followed by a UID change event indicating a transition to root. Adversaries may use unshare-based primitives as part of local privilege escalation chains. This rule is intentionally generic and can surface multiple local privesc patterns beyond a single CVE.

Tags

Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Privilege EscalationUse Case: VulnerabilityData Source: Elastic DefendLanguage: eql

Severity

high

Risk Score

MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Exploitation for Privilege Escalation (T1068)(external, opens in a new tab or window)

↳ Abuse Elevation Control Mechanism (T1548)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-endpoint.events.process*
Related Integrations: endpoint(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗sequence by process.parent.entity_id, host.id with maxspan=60s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
    process.name == "unshare" and process.args : ("-r", "-rm", "m", "-U", "--user") and user.id != "0"]
  [process where host.os.type == "linux" and event.action == "uid_change" and event.type == "change" and
    user.id == "0"]

Install detection rules in Elastic Security

Detect Potential Privilege Escalation via unshare and UID Change in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).