Emerging Threathighexperimental

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawn Poudel (Nextron Systems)Created Thu Oct 02Updated Tue Mar 3110ac0730-c24e-4f4c-81f8-b13a1ac95a1d2025

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

LinuxFile Event

ProductLinux← raw: linux

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '/etc/nsswitch.conf'
    filter_main_legitimate_path:
        TargetFilename:
            - '/etc/nsswitch.conf'
            - '/usr/share/factory/etc/nsswitch.conf'
    condition: selection and not 1 of filter_main_*