NexurAI
Foothold to SYSTEM/root: the local flaws that finish the job after initial access.
A memory-corruption bug in pkexec lets any local user escalate to root - present in default installs for over a decade.
polkit's pkexec (most Linux distributions) · 2022
The attacker runs pkexec with crafted argument/environment vectors that trigger out-of-bounds writes, gaining a root shell locally.
Hunt for pkexec executions with unusual environments, unexpected root shells spawned from pkexec, and auditd execve anomalies.
Patch polkit; as a stopgap, remove the SUID bit from pkexec.
The Print Spooler service lets an authenticated user load an arbitrary driver DLL as SYSTEM - remote code execution and privilege escalation.
Windows Print Spooler (RpcAddPrinterDriverEx) · 2021
The attacker points the spooler at a malicious 'printer driver' DLL on a share; spoolsv.exe loads it with SYSTEM privileges and runs the payload.
Watch spoolsv.exe spawning cmd/powershell or writing DLLs under C:\Windows\System32\spool\drivers; alert on new drivers added over RPC/SMB.
Patch, disable the Print Spooler where not needed, and restrict 'Point and Print' driver installation to administrators.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.