Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
3
Contributors
3
2
1
Categories
5
5
2
2
1
Platforms
6
2
Products / Services
3
2
1
1
MITRE Techniques
6
5
CVEs
71
71
64
58
49
Detects exploitation attempts against CVE-2021-3156 (Baron Samedit) involving the sudoedit command invoked with the shell-mode flag (-s) and a trailing backslash argument, which is a known trigger for the heap overflow vulnerability in sudo.
Detects exploitation attempts against CVE-2021-3156 (Baron Samedit) involving the sudoedit command invoked with the shell-mode flag (-s) and a trailing backslash argument, which is a known trigger for the heap overflow vulnerability in sudo.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
The analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \" command. This detection leverages logs from Linux systems, specifically searching for instances of the sudoedit command with the "-s" flag followed by a double quote. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows attackers to gain root privileges. If confirmed malicious, this could lead to complete system compromise, unauthorized access to sensitive data, and potential data breaches.
This analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.
The analytic detects the execution of the "sudoedit -s *" command, which is associated with the Baron Samedit CVE-2021-3156 heap-based buffer overflow vulnerability. This detection leverages the `osquery_process` data source to identify instances where this specific command is run. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows privilege escalation. If confirmed malicious, an attacker could gain full control of the system, execute arbitrary code, or access sensitive data, leading to potential data breaches and system disruptions.