Loading story…
Splunk released a Linux anomaly detection analytic for suspicious staging of alternate system files associated with CVE-2025-32463 (chwoot), a local privilege-escalation technique that abuses fake root directories and spoofed configuration files. The analytic looks for creation of sensitive files such as passwd, shadow, sudoers, nsswitch.conf, and libnss libraries outside expected locations, aiming to catch attempts to influence how privileged processes including sudo resolve name services.
The detection uses Endpoint telemetry mapped to the Splunk CIM Filesystem data model and is designed to identify filesystem activity outside normal paths such as /etc and /var/lib/docker. Splunk said the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts because legitimate development, testing, and container-related activity may trigger false positives. Separately, MITRE ATT&CK documents Aoqin Dragon (G1007) as a suspected Chinese cyber-espionage group targeting government, education, and telecommunications organizations in the Asia-Pacific region, though the reference does not tie the group directly to the chwoot detection.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its "Linux Suspicious Staging of Alternate System Files" anomaly detection on 2026-07-08. The analytic is tied to CVE-2025-32463 ("chwoot") and detects suspicious creation of alternate system files and NSS libraries outside normal locations as a potential local privilege escalation technique.
MITRE ATT&CK describes Aoqin Dragon as a suspected Chinese cyber-espionage group active since at least 2013, primarily targeting government, education, and telecommunications organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Splunk documented and later removed a detection for privilege escalation in which low-privilege users could abuse the `edit_user` capability to obtain administrative access. The analytic monitored `_audit` logs for password-related actions including `change_own_password`, `password_change`, and `edit_password` when access was granted to accounts that were not administrators or system users, and warned that successful exploitation could result in full control of the Splunk environment and potential data exposure. The detection was mapped to MITRE ATT&CK technique **T1548: Abuse Elevation Control Mechanism**, which covers privilege escalation and defense evasion through misuse of built-in control mechanisms across platforms. Splunk marked the analytic as deprecated and removed it after the underlying issue, tracked as **`CVE-2023-32707`**, was patched in current releases, noting the detection had been disabled by default, required access to the `_audit` index, and could produce false positives during legitimate password changes.
Aug 12, 2026
Splunk published a detection analytic for Linux systems that identifies suspicious compiler activity building shared objects with initialization functions, a pattern associated with post-exploitation, persistence, and privilege-escalation tradecraft. The analytic looks for `gcc` and related compiler processes using flags such as `-shared` and linker options matching `-Wl,-init,*` while producing `.so` output, and it references **CVE-2025-32463** as a related concern. The rule is disabled by default, runs hourly when enabled, and depends on EDR or Sysmon for Linux process telemetry mapped into Splunk's Endpoint data model. The behavior aligns with several **MITRE ATT&CK** techniques, including **Shared Modules** (`T1129`), **Stage Capabilities** (`T1608`), and **Compile After Delivery** (`T1027.004`). ATT&CK describes adversaries loading malicious functionality through shared libraries and dynamically resolving code at runtime, while staged capabilities can be hosted or prepared on attacker-controlled infrastructure before delivery. Splunk warned that legitimate software development can produce similar compiler activity, so defenders are advised to tune out trusted build workflows while prioritizing unexpected `.so` compilation with initialization routines on production or non-development Linux hosts.
Aug 12, 2026