Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
The Trustwave Threat Hunting team has authored a practical guide to help the cybersecurity community address the Linux “polkit” Local Privilege Escalation vulnerability (CVE-2021-4034) by identifying common behavior in exploitation.
On January 25, 2022, Qualys released a research blog detailing a critical vulnerability (aka PwnKit) in the “polkit” component available by default in almost all Linux distributions. At the time of this writing, the Trustwave Threat Hunt team has not witnessed any attacks in the wild using this Local Privilege Escalation.
Our team of threat hunters leveraged the Endpoint Detection and Response (EDR) API across our advanced tier client environment to determine if there was activity from non-root users accessing the ‘gconv-module’ file. This action can also be performed via a normal EDR query or a File Integrity Monitor. If there are findings where non-root users are seen modifying or acting on this file, the following techniques can be used to determine if it is malicious activity indicative of PwnKit exploitation.
./anyname
or
anyname.py
or
anyname.sh
sh -c gcc -o payload.so -shared -fPIC payload.c
Although Local Privilege Escalation vulnerabilities require access to the vulnerable system, do not discount this vulnerability. When paired with any simple Remote Code Execution (RCE) vulnerability, this becomes a part of a critical attack chain. Given the massive attack surface that affects most every Linux distribution, this vulnerability will have legs that make it a threat well into 2022.
For more information about PwnKit (CVE-2021-4034), please refer to our Action Response.
Not every organization has the resources or expertise to perform Threat Hunting. Trustwave offers Threat Hunting services that combine human experts and automated processes to bring you purpose-built threat hunting capabilities that help you stay ahead of advanced adversaries.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.