{"id":"f2bed782-994e-4f40-9cd5-518198cb3fba","title":"Linux Sudo Chroot Execution","description":"Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.\nAttackers may use this technique to evade detection and execute commands in a modified environment.\nThis can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.\nWhile investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.\n","author":"Swachchhanda Shrawn Poudel (Nextron Systems)","status":"experimental","level":"low","date":"2025-10-02","modified":"","tags":["attack.privilege-escalation","attack.t1068"],"technique_ids":["T1068"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management."],"references":["https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh"],"source_path":"rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml","source_sha256":"db8911e31e661b34c46d79c856e996e2a0ca5082e309795d5641e6b5d682c4a2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Sudo Chroot Execution\nid: f2bed782-994e-4f40-9cd5-518198cb3fba\nstatus: experimental\ndescription: |\n    Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.\n    Attackers may use this technique to evade detection and execute commands in a modified environment.\n    This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.\n    While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.\nreferences:\n    - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh\nauthor: Swachchhanda Shrawn Poudel (Nextron Systems)\ndate: 2025-10-02\ntags:\n    - attack.privilege-escalation\n    - attack.t1068\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/sudo'\n        CommandLine|contains:\n            - ' --chroot '\n            - 'sudo -R '\n    condition: selection\nfalsepositives:\n    - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"}],"data_path":"data/detection-rules/f2bed782-994e-4f40-9cd5-518198cb3fba.json","kind":"sigma"}