Linux Privilege Escalation

Wazuh detected a sequence of security-relevant events on the monitored Ubuntu endpoint, including privileged command execution, creation of a new user account, elevation to the root account, and modification of account credentials.

The events were correlated into a single privilege escalation investigation. The activity demonstrated how an authenticated user could obtain elevated access and make administrative changes that would require immediate validation in a production environment.

The activity occurred during an authorized home-lab exercise. No evidence of unauthorized persistence, lateral movement, malware execution, or data exfiltration was identified.

The investigation began with a review of the Wazuh alerts associated with the Ubuntu endpoint. The alerts showed a clear progression from normal authenticated activity into privileged administrative actions.

Initial sudo execution established that elevated privileges were being requested. The subsequent creation of a new local account, transition to a root shell, and modification of a password increased the security relevance of the activity.

In a production environment, this sequence could indicate unauthorized privilege escalation, persistence preparation, or manipulation of account access. The analyst would need to verify the initiating user, review command history, confirm whether the new account was approved, and determine which account password was modified.

Review of the available lab evidence found no additional indicators of malicious persistence, remote access, lateral movement, malware execution, or data exfiltration. The events were confirmed as part of an authorized exercise designed to validate Wazuh monitoring and incident reconstruction.

Individual administrative events may appear legitimate when viewed separately. Correlating sudo execution, account creation, root access, and password modification provides stronger context and supports more accurate incident classification.

Linux privilege escalation investigations should include validation of the initiating user, command history, account changes, active sessions, privileged group membership, authentication activity, and possible persistence mechanisms.

The exercise also demonstrated the value of centralized monitoring. Wazuh allowed multiple Linux events to be reviewed together rather than treating each alert as an isolated occurrence.

The investigation successfully reconstructed a Linux privilege escalation sequence using Wazuh alerts and supporting Linux system activity. The sequence included sudo execution, account creation, elevation to root, and password modification.

Although the actions were authorized as part of a controlled home-lab exercise, the same event pattern in a production environment would warrant immediate investigation and validation.

This case demonstrates practical experience with Linux security monitoring, SIEM alert correlation, MITRE ATT&CK mapping, incident analysis, and professional cybersecurity documentation.