Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,731
Ready to search
Backends
17
Loaded from pysigma-node
pySigma Versions
10
Newest: 1.3.3
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
PwnKit Local Privilege Escalation
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Conversion Output
PwnKit Local Privilege Escalation
Using Splunk · Default · pySigma 1.3.3
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion1.3.3
title: PwnKit Local Privilege Escalation
id: 0506a799-698b-43b4-85a1-ac4c84c720e9
status: test
description: Detects potential PwnKit exploitation CVE-2021-4034 in auth logs
references:
- https://twitter.com/wdormann/status/1486161836961579020
author: Sreeman
date: 2022-01-26
modified: 2024-09-11
tags:
- attack.defense-evasion
- attack.privilege-escalation
- attack.t1548.001
- detection.emerging-threats
- cve.2021-4034
logsource:
product: linux
service: auth
detection:
keywords:
'|all':
- 'pkexec'
- 'The value for environment variable XAUTHORITY contains suspicious content'
- '[USER=root] [TTY=/dev/pts/0]'
condition: keywords
falsepositives:
- Unknown
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml