Nimbuspwn Privilege Escalation Exploitation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects exploitation attempts related to the Nimbuspwn privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) on Linux systems. The rule looks for specific keywords that indicate the `networkd-dispatcher` service is being manipulated, potentially to execute arbitrary code with elevated privileges.