Suspicious Shell from SUID Binary (CVE-2026-45257 BUMSRAKETE)

Ethan Andrews@eandrews

•updated Jun 12, 2026•3•0•5

This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).