PrivDrift

PrivDrift monitors Linux systems for unauthorized privilege changes by comparing live state against a trusted baseline — surfacing exactly what changed, where, and how risky it is.

Privilege escalation often leaves a quiet trail: a new SUID binary, a modified sudoers rule, a UID-0 account added outside normal provisioning. These changes are easy to miss without an established baseline to compare against, and most hosts have no lightweight way to track privilege drift over time.

1. 01Collector
   Gathers current system state: SUID/SGID bits, sudo rules, privileged group membership, UID 0 accounts, and cron entries.
2. 02Baseline
   Stores a trusted snapshot of system state to compare future collections against.
3. 03Detector
   Performs deterministic snapshot comparison between the baseline and current state.
4. 04Reporter
   Applies rule-based risk scoring and renders results as JSON reports and an HTML dashboard.

PrivDrift treats a known-good system state as ground truth. Every subsequent run recollects the same signals and diffs them against that baseline, so any privilege-relevant change is caught deterministically rather than inferred heuristically — then scored by risk so the highest-impact drift surfaces first.

1. The Collector module walks the filesystem and system configuration for SUID/SGID binaries, sudoers rules, privileged group membership, UID 0 accounts, and cron entries.
2. The Baseline module persists this collected state as the trusted reference snapshot.
3. The Detector module performs a deterministic diff between the current collection and the stored baseline.
4. The Reporter module applies rule-based risk scoring to each detected change and renders both a JSON report and an HTML dashboard for review.
5. The entire pipeline runs with zero external dependencies, keeping it portable across Linux environments.

• Keeping the tool dependency-free while still producing a readable HTML dashboard.
• Designing a risk-scoring model that ranks drift by real impact rather than flat severity.
• Ensuring deterministic comparisons so the same state never produces inconsistent diff results.

• A clear Collector–Baseline–Detector–Reporter pipeline keeps each concern testable in isolation.
• Zero-dependency design pays off for a security tool meant to run on untrusted or minimal hosts.
• Rule-based risk scoring is often more transparent and auditable to security teams than opaque ML scoring for this kind of drift detection.

• Add continuous/scheduled monitoring with alerting instead of manual snapshot comparison.
• Extend collection to include kernel module and capability-based privilege signals.
• Support baseline versioning to track intentional, approved privilege changes over time.