Local Privilege Escalation

This document describes how to view and handle the details of privilege escalation events and guides you on how to create an allowlist to set the allowed privilege escalation behaviors.

Background Information

If someone enters the system with low privileges and uses certain means to elevate privileges to obtain high privileges, it is very likely an attack by a hacker, which will endanger the security of the host. The local privilege escalation feature can monitor privilege escalation events on your cloud virtual machine in real time and can view and handle privilege escalation event details. It also supports the allowlist creation feature for setting allowed privilege escalation behaviors.

Operation Steps

Alarm List

1. Log in to the tenant-side console of CWPP. In the left sidebar, select Intrusion Detection > Local Privilege Escalation to enter the event list tab of local privilege escalation.
2. On the event list tab of local privilege escalation, you can view the list of local privilege escalation events and perform related operations.
   On the alarm list tab, you can view information such as the hostname/instance ID, IP address, elevated user, parent process, parent process user, discovery time, and status of the host where the privilege escalation event occurred. The list display fields are customizable.
   • Filter event: The local privilege escalation event list supports selecting a date to view corresponding events, supports querying events by keyword and tag (multiple keywords are separated by the vertical bar "|", and multiple filter tags are separated by the Enter key), and simultaneously supports filtering events by status.
   • Customize list fields: Above the local privilege escalation alarm list, click the setting icon to set the list display field. After completing the selection, click Confirm to complete the setting.
   • Event export: Above the local privilege escalation alarm listto export the local privilege escalation alarm list.
   • Detailed information: In the right operation column of local privilege escalation event, click Details to view local privilege escalation event details.
     • Mark as processed: If you have manually processed the alarm, you can mark the alarm as processed.
     • Add to allowlist: Add the privilege escalation process of the current alarm server to the allowlist. Subsequently, no alarms will be generated when the same privilege escalation behavior is detected again.
     • Ignore: Only ignore this alarm. If the same situation occurs, an alarm will still be triggered.
     • Delete a record: Delete the alarm record. The console will no longer display it. Deleted records cannot be restored. Proceed with caution.

Allowlist Management

The local privilege escalation feature supports adding an allowlist. By setting allowlist privilege escalation conditions, events that meet the conditions are marked as part of the allowlist.

1. Log in to the tenant-side console of CWPP. In the left sidebar, select Intrusion Detection > Local Privilege Escalation to open the Local Privilege Escalation page.

2. On the Local Privilege Escalation page, select Allowlist Management > Add Allowlist.

3. In the pop-up window for adding to allowlist, set privilege escalation conditions, including: processes with S permissions, custom privilege escalation process (support multiple process names, separated by commas, for example, 123.exe,test.exe), and at the same time select the server range covered by the condition, click OK.

   Note:

   • s permission: grant file permissions of the file owner during the execution phase, equivalent to temporarily assuming the identity of the file owner.
   • When ticking two conditions, they need to be satisfied simultaneously to hit allowlist.
   • If the server range is set to all servers, trust will be added to all servers under the user's APPID for this allowlist condition. Proceed with caution.

4. After the settings are completed, you can view the condition in the allowlist management list. Events in the alarm list that meet the condition will be marked as allowlist events.

5. On the allowlist management page, you can perform filter and delete operations on the allowlist.

   • Filtering: The configured allowlist supports querying by keywords and tags (multiple keywords are separated by the vertical bar "|", and multiple filter tags are separated by the Enter key). It also supports filtering by whether S permissions are granted.
   • Customize list fields: Above the allowlist, you can set the list display field. After completing the selection, click Confirm to successfully set.
   • Edit: In the right operation column of the target allowlist, click Edit to edit the created allowlist.
   • Delete: In the allowlist, deletion of the configured allowlist is supported.