| LinPEAS / mass enum | Burst of find / -perm, hundreds of reads, which/getcap spam | auditd execve of linpeas; EDR file-scan anomaly | Prefer targeted enum (linpriv_enum.py --quick); avoid full FS walks on EDR hosts |
| SUID/GTFOBins escape | setuid() to 0 from non-root parent, shell with -p | auditd uid-change without login; Falco Run shell untrusted | Use the least-noisy binary; many GTFOBins one-liners are flagged by name |
| sudo CVE-2025-32463 | syslog sudo ... CHROOT=, NSS libnss_*.so from world-writable path | Elastic "Potential CVE-2025-32463 Sudo Chroot Execution"; auditd -R usage | chroot dir + fake nsswitch.conf are durable IOCs — clean the tree |
| sudo CVE-2025-32462 | sudo log with -h/HOST mismatch vs real hostname | auditd sudo with --host not paired with -l | leaves clean sudo log entry; blends with normal sudo |
| nf_tables CVE-2024-1086 | unshare/CLONE_NEWUSER + nftables from non-root; dmesg slab/UAF | Falco Unprivileged Delegation of Page Faults; auditd unshare+nft | namespace creation is logged; disable userns to neutralize |
| io_uring LPE | io_uring_setup syscall from unexpected proc | auditd syscall=io_uring_setup; eBPF LSM | many distros now ship io_uring_disabled=2 |
| Looney Tunables CVE-2023-4911 | setuid exec with GLIBC_TUNABLES= containing =; core dumps | Elastic "Potential Privilege Escalation via CVE-2023-4911" | env var is recorded in auditd execve; unset before exec where possible |
| udisks CVE-2025-6019 | D-Bus Filesystem.Resize/Check, loop mount in /tmp w/o nosuid | auditd mount w/o nosuid; Falco mount-from-loop | leaves loop device + XFS image; detach + shred image |
| pkexec PwnKit | pkexec with argc==0, GCONV_PATH= env, /var/... GConv module | auditd pkexec + empty argv; Sigma proc_creation_lnx_pkexec | dropped GConv .so + dir are IOCs; remove them |
| Container escape (runc) | /proc/self/fd/* cwd, host paths from container, runc exec anomalies | Falco Container escape/Mount launched in container; CrowdStrike CWP | escapes are heavily monitored in CWP — confirm scope before running |
| cron/PATH/writable unit | new file in /etc/cron*, systemctl daemon-reload, PATH-prepended bin | auditd watch on /etc/cron*,/etc/systemd/*; Sigma cron tamper | revert file mtimes / remove dropped scripts post-exploit |
