PwnKit Local Privilege Escalation Attempt

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•53

Detects potential exploitation of the PwnKit vulnerability (CVE-2021-4034) by looking for specific keywords in authentication logs. The rule identifies attempts to execute 'pkexec' with suspicious environment variable content and specific user/TTY information, indicative of a local privilege escalation attempt.