Linux SUID Binaries and GTFOBins: Hunting Privilege Escalation with Auditd

In Linux operating systems, the Set Owner User ID (SUID) permission bit allows an executable file to run with the privileges of the file owner rather than the privileges of the user who launched it. When standard utility binaries such as find, awk, python, or cp are assigned SUID root permissions, local unprivileged users can abuse built-in command execution flags to spawn an interactive root shell.

The GTFOBins project curates Unix binaries that can bypass local security restrictions. Detecting SUID abuse requires tracking process execution events where the effective user ID (euid) transitions to root while the audit user ID (auid) remains that of an unprivileged account.

Common SUID abuse patterns in the wild

System administrators occasionally apply SUID flags to utility binaries to permit automated backup scripts or monitoring agents to read restricted directories. Threat actors discover these permissions using local discovery commands:

find / -perm -4000 -type f 2>/dev/null

Once identified, attackers exploit command execution features:

• find: The -exec parameter evaluates commands. If find has SUID set, running `find . -exec /bin/sh -p \; -quit` spawns a root shell that preserves effective user privileges via the `-p` switch.
• awk: The built-in system() function executes system commands: `awk 'BEGIN {system("/bin/sh")}'`.
• cp: When cp retains SUID root, an attacker overwrites `/etc/passwd` or `/etc/shadow` with a custom password hash, creating a persistent root account.
• python3: Running `python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'` replaces the Python process with a root shell.

Configuring Linux auditd to capture SUID execution

The Linux Audit framework (auditd) provides kernel-level visibility into process execution. To monitor execution of commands by unprivileged users, add rules to /etc/audit/rules.d/audit.rules:

-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k suid_escalation
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k suid_escalation

The filter condition -C uid!=euid -F euid=0 ensures auditd logs an event only when the real user ID does not match the effective user ID and the effective user ID is root (0). This eliminates log volume from standard commands while capturing every instance where a user launches an SUID binary.

A resulting audit log record in `/var/log/audit/audit.log` shows:

type=EXECVE msg=audit(1728212040.123:456): argc=5 a0="find" a1="." a2="-exec" a3="/bin/sh" a4="-p"
type=SYSCALL msg=audit(1728212040.123:456): arch=c000003e syscall=59 success=yes exit=0 a0=55d... a1=55d... a2=55d... a3=0 items=2 ppid=1234 pid=5678 auid=1001 uid=1001 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="find" exe="/usr/bin/find" key="suid_escalation"

Sigma detection for Linux SUID shell execution

This Sigma rule flags suspicious shell spawns where common GTFOBins utilities appear as the parent process:

title: Shell Execution via GTFOBin Parent Process
status: stable
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/find'
- '/awk'
- '/gawk'
- '/nawk'
- '/tar'
- '/zip'
- '/cp'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
condition: selection_parent and selection_child

Audit and remediation workflow

Audit your Linux fleet on a scheduled cadence using configuration management tools like Ansible, Puppet, or Salt. Remove SUID permissions from non-essential binaries using `chmod u-s /path/to/binary`. Mount user-writable partitions such as `/tmp` and `/home` with the `nosuid` and `noexec` options in `/etc/fstab` to prevent attackers from compiling custom SUID binaries locally.

Explore the find LOLBin entry in our directory, inspect other Unix tools in the Linux LOLBin catalog, and check the Execute category. You can also review community detection logic in our Sigma rule library.

For reference material on GTFOBins and Linux audit architecture, refer to the GTFOBins Catalog and Red Hat Enterprise Linux Audit System Documentation.