Name:Linux Suspicious Namespace Creation id:039dbee4-39d8-4ad0-a43a-df4db3a41990 version:1 date:None author:Raven Tait, Splunk status:production type:TTP Description:The following analytic detects an unprivileged user invoking the unshare syscall with user namespace flags followed within 120 seconds by a root-owned shell or interpreter spawning under the same parent process, correlating auditd syscall telemetry with Sysmon process creation events to identify the two-step sequence characteristic of user-namespace-based Linux kernel privilege escalation exploits such as DirtyFrag. Data_source:
| where match(Image, "/(su|sudo|pkexec|passwd|chsh|newgrp|doas|run0|sg|dash|sh|bash|zsh|fish|ksh|csh|tcsh|ash|mksh|busybox|tmux|screen|node|python[^/]*|perl[^/]*|ruby[^/]*|php[^/]*|lua[^/]*)$")
| table host, unshare_ppid, root_spawn_time, root_pid, root_exe, root_cmdline, root_parent, unshare_time, action, original_file_name, parent_process, parent_process_exec, parent_process_guid, parent_process_id, parent_process_name, parent_process_path, process, process_exec, process_guid, process_hash, process_id, process_integrity_level, process_name, process_path, user, user_id, vendor_product ] | where (root_spawn_time - unshare_time) >= 0 | where (root_spawn_time - unshare_time) <= 120 | eval elapsed_sec=round(root_spawn_time - unshare_time, 2) | eval ioc_match=case( ns_flags="50000000", "dirtyfrag (CLONE_NEWUSER|CLONE_NEWNET)", ns_flags="10000000", "CLONE_NEWUSER only", ns_flags="70000000", "CLONE_NEWUSER|CLONE_NEWNET|CLONE_NEWPID", 1=1, "namespace flags="+ns_flags ) | rename host as dest | stats count AS count, min(unshare_time) AS firstTime, max(unshare_time) AS lastTime, values(trigger_uid) AS trigger_uid, values(trigger_auid) AS trigger_auid, values(trigger_exe) AS trigger_exe, values(ns_flags) AS ns_flags, values(ioc_match) AS ioc_match, values(unshare_pid) AS unshare_pid, values(unshare_ppid) AS unshare_ppid, values(root_exe) AS root_exe, values(root_cmdline) AS root_cmdline, values(root_pid) AS root_pid, values(elapsed_sec) AS elapsed_sec, values(process_hash) AS process_hash, values(vendor_product) AS vendor_product by dest, comm, syscall | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_namespace_creation_filter`
how_to_implement:To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed. known_false_positives:No false positives have been identified at this time. References: -https://www.elastic.co/security-labs/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Linux Privilege Escalation']
