Loading story…
Security content from Elastic and Splunk highlights two Linux behaviors that defenders should monitor closely: unauthorized privilege escalation through setuid execution and deletion of web server access logs. Splunk published an anomaly detection for Linux auditd that flags execve syscall 59 events where a non-root user gains effective UID 0 without a matching successful PAM authentication event in the same audit session, a pattern associated with privilege escalation and mapped to MITRE ATT&CK T1068; the rule also references CVE-2026-46331 and notes that some scheduled tasks can produce false positives.
Elastic separately documented a prebuilt rule for detecting deleted web server access logs, while ThreatBear provided tuning guidance showing how legitimate activity on Mitel MiCollab systems can create noisy process trees and trigger alerts such as suspicious Java child processes and logfile deletion detections. The combined guidance underscores that Linux monitoring programs should pair coverage for high-risk behaviors with environment-specific exceptions so defenders can preserve visibility into real attacks without overwhelming analysts with benign alerts.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
ThreatBear published guidance on reducing false positives when monitoring Mitel MiCollab systems, including recommendations to tune suspicious Java child process and logfile deletion detections for known Mitel-specific activity.
Splunk published the 'Linux Auditd Possible Setuid Execve Privesc' detection, which flags execve events where a non-root user gains effective UID 0 without a corresponding PAM authentication event. The detection is mapped to ATT&CK T1068 and references CVE-2026-46331.
Elastic published documentation for its prebuilt detection rule 'WebServer Access Logs Deleted,' describing detection logic for deletion of web server access logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceelastic.co
Open sourcethreatbear.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Linux defenders are being urged to detect local privilege escalation through behavioral correlations rather than signatures for individual CVEs. Elastic’s framework combines endpoint and Auditd telemetry to identify unprivileged processes that reach UID 0 after executing from writable paths, invoking suspicious SUID/SGID binaries, manipulating user namespaces with `unshare`, abusing trusted helpers, or accessing privileged data. Testing covered 11 public proof-of-concept exploits and SUID misconfigurations, including page-cache corruption, D-Bus, namespace, and file-descriptor-theft techniques; the researchers caution that custom evasion-focused exploits may bypass coverage. The guidance follows active risk from page-cache vulnerabilities including **Copy Fail** (`CVE-2026-31431`), which is reported exploited in the wild and listed in CISA’s KEV catalog, and DirtyFrag. These flaws can modify cached readable files—including SUID binaries, `/usr/bin/su`, or `/etc/passwd`—to gain root, with suspicious socket, `splice()` and namespace activity providing detection opportunities. Defenders should patch affected kernels, consider restricting unprivileged user namespaces and relevant kernel modules after compatibility testing, and evict page cache after mitigation. They should also monitor `/proc/sys/fs/binfmt_misc` for new or changed handlers and attacker-controlled interpreters, as the `binfmt_misc` credentials flag can redirect a legitimate SUID program to a malicious handler that inherits root privileges without the handler carrying a SUID bit.
Sep 11, 2026
Elastic Security Labs published a series of Linux detection-engineering guides covering attacker persistence through scheduled tasks, `systemd` units, shell profiles, XDG autostart, permission and account changes, SSH keys, SysV/Upstart/`rc.local` startup paths, dynamic MOTD scripts, udev rules, package-manager hooks, Git hooks, process capabilities, and system-binary hijacking. The research maps techniques to MITRE ATT&CK and uses the PANIX simulation tool to demonstrate how adversaries can retain access or launch reverse shells, while recommending endpoint, file-integrity, process, network, service-state, and syslog telemetry alongside Elastic rules, ES|QL, and OSQuery hunts. The latest guidance highlights high-impact persistence through malicious PAM changes, DPKG/RPM lifecycle scripts, and dangerous Docker deployments. Defenders should monitor PAM and package-management paths, suspicious child processes and outbound connections, lifecycle-script execution, and container settings such as privileged mode, host PID namespaces, and sensitive host mounts. Elastic cautions that boot-time persistence may execute before endpoint agents collect process events, making early file-change detection and proactive hunting essential; organizations should also tune detections for legitimate administration and remove obsolete Upstart systems from production.
Sep 9, 2026