T1068 — Exploitation for Privilege Escalation

Tactic: Privilege Escalation · Platforms: Containers, Linux, macOS, Windows

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute…

Sigma detection rules (4)

T1068 Exploitation for Privilege Escalation

title: T1068 Exploitation for Privilege Escalation
id: acc8ff72-e036-43e1-bae8-1d13f8f0f984
description: 'Detects loading of an unsigned kernel driver or a driver matching known vulnerable/exploitable driver names, commonly abused in Bring-Your-Own-Vulnerable-Driver privilege-escalation exploits. Corrected from a service:security definition paired with Sysmon-only EventID 6 (Driver Load), a non-existent event/log pairing. Data Component: Driver Load. Tune using: DriverNamePattern, TimeWindow, ParentProcessPath.'
references:
  - https://attack.mitre.org/techniques/T1068
author: Shahrukh Khan
date: 2026-03-11
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1068

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 6
  selection_unsigned:
    Signed: 'false'
  selection_vulnerable_driver:
    ImageLoaded|contains:
      - 'RTCore64.sys'
      - 'gdrv.sys'
      - 'dbutil_2_3.sys'
      - 'WinRing0x64.sys'
      - 'Zemana'
  condition: selection and (selection_unsigned or selection_vulnerable_driver)

falsepositives:
  - Legitimate unsigned drivers used during internal hardware/driver development or testing.
  - Approved third-party hardware utilities bundling one of the flagged legacy driver names for non-malicious purposes.

level: high

T1068 Exploitation for Privilege Escalation

title: T1068 Exploitation for Privilege Escalation
id: 7180803a-0dea-4e0f-98f3-1f46a7fcdf90
description: 'Detects processes whose auditd SYSCALL record shows an effective UID of 0 (root) while the real UID is non-root and the responsible binary is not on an allow-list of standard setuid utilities (sudo, su, passwd, ping, mount, pkexec, etc.) - a proxy for unexpected/unauthorized privilege gain more consistent with exploitation of a vulnerability than routine setuid execution. This drops the prior hardcoded uid=1000 assumption (which only covered one user) in favor of any non-root uid, and adds the allow-list the original rule admitted it needed. Auditd alone still cannot confirm an exploit occurred versus an unlisted-but-legitimate setuid tool; pairing with a crash/signal precursor (ANOM_ABEND) would sharpen this further. Tune using: SetUIDBinaryList, TimeWindow, EffectiveUIDThreshold.'
references:
  - https://attack.mitre.org/techniques/T1068
author: Shahrukh Khan
date: 2026-02-17
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1068

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_euid_root:
    type: SYSCALL
    success: 'yes'
    euid: '0'
  filter_already_root:
    uid: '0'
  filter_known_setuid_binaries:
    exe|endswith:
      - '/sudo'
      - '/su'
      - '/passwd'
      - '/ping'
      - '/ping6'
      - '/mount'
      - '/umount'
      - '/pkexec'
      - '/gpasswd'
      - '/chsh'
      - '/chfn'
      - '/newgrp'
      - '/fusermount'
      - '/fusermount3'
      - '/crontab'
      - '/mtr-packet'

  condition: selection_euid_root and not filter_already_root and not filter_known_setuid_binaries

falsepositives:
  - Setuid binaries not included in the allow-list (third-party or distro-specific tools) will still trigger; environments should extend SetUIDBinaryList rather than relying on the default set, and this rule cannot on its own distinguish a genuine exploit from an unlisted-but-legitimate setuid tool.

level: high

T1068 Exploitation for Privilege Escalation

title: T1068 Exploitation for Privilege Escalation
id: adbdcf95-36b2-4f6b-bdfb-b0b53523d3af
description: 'Detection Strategy for Exploitation for Privilege Escalation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EntitlementList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1068
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1068

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|contains: '/private/tmp/'
  selection_root:
    ParentImage|endswith:
      - '/sudo'
      - '/su'
  condition: selection and selection_root

falsepositives:
  - Legitimate administrative scripts executed from temporary paths with elevated privileges, since actual exploitation of a vulnerable entitlement or kernel primitive is not observable through process_creation events alone and requires Endpoint Security API-level exploit telemetry.

level: high

T1068 Exploitation for Privilege Escalation

title: T1068 Exploitation for Privilege Escalation
id: 14813c8b-d395-40c5-b959-7bb89949e610
description: 'Detection Strategy for Exploitation for Privilege Escalation. unshare/nsenter/capsh are legitimate namespace-management tools, not vulnerability exploitation (that activity pattern is closer to T1611 Escape to Host). Retargeted to real exploitation-adjacent signals auditd can actually expose: kernel module load syscalls (init_module/finit_module), correlated with .ko files staged in non-standard, world-writable locations (/tmp, /dev/shm, /var/tmp) as would occur when a BYOVD or kernel-exploit payload is loaded outside the normal /lib/modules tree. Tune using: KnownSignedModulePaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1068
author: Shahrukh Khan
date: 2026-03-08
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1068

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_module_load:
    type: SYSCALL
    syscall:
      - init_module
      - finit_module
    success: 'yes'
  selection_suspicious_ko_path:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|endswith: '.ko'
    name|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'

  condition: 1 of selection_*

falsepositives:
  - Legitimate driver installs and DKMS module rebuilds also call init_module/finit_module; scope KnownSignedModulePaths to exclude vendor-signed modules loaded from the standard /lib/modules tree.

level: high

Explore