Name:Linux Auditd Process Image Change Under Same PID id:61ebf529-a27d-4e56-bb9b-40b316e6a861 version:1 date:None author:Raven Tait, Splunk status:production type:TTP Description:This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds.
A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity. Data_source:
-Linux Auditd Syscall
search:`linux_auditd` type=SYSCALL success="yes" ( syscall IN ("59", "221", "11") OR SYSCALL="execve" )
| sort 0 _time
| streamstats current=f window=1 global=f last(exe) as previous_exe last(_time) as previous_time last(ppid) as previous_ppid by host pid
| where isnotnull(previous_exe) AND previous_exe!=exe AND ppid=previous_ppid AND transition_seconds>=1 AND transition_seconds<=60
| stats count as transition_count min(previous_time) as firstTime max(_time) as lastTime values(comm) as process_name values(uid) as uid values(auid) as auid values(subj) as subj by host pid ppid previous_exe exe
how_to_implement:To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives:Some applications may intentionally replace their executable image after performing setup or initialization. Review the executable transition, elapsed time, parent process, host role, and related activity; tune the filter macro for expected workloads. References: -https://man7.org/linux/man-pages/man2/execve.2.html -https://access.redhat.com/security/vulnerabilities/RHSB-2026-015 drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Compromised Linux Host', 'Linux Privilege Escalation', 'Node2Shell']
