Emerging Threatcriticaltest

Sudo Privilege Escalation CVE-2019-14287 - Builtin

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Tue Oct 15Updated Sat Nov 267fcc54cb-f27d-4684-84b7-436af096f8582019

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Linuxsudo

ProductLinux← raw: linux

Servicesudo← raw: sudo

Detection Logic

detection:
    selection_user:
        USER:
            - '#-*'
            - '#*4294967295'
    condition: selection_user

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation

Techniques

T1068 · Exploitation for Privilege Escalation

Sub-techniques

T1548.003 · Sudo and Sudo Caching

Other

cve.2019-14287detection.emerging-threats

Related Rules

DerivedEmerging Threathigh

Sudo Privilege Escalation CVE-2019-14287

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

7fcc54cb-f27d-4684-84b7-436af096f858

Status

test

Level

critical

Type

Emerging Threat

Created

Tue Oct 15

Modified

Sat Nov 26

Author

Florian Roth (Nextron Systems)

Path

rules-emerging-threats/2019/Exploits/CVE-2019-14287/lnx_sudo_exploit_cve_2019_14287.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1068attack.t1548.003cve.2019-14287detection.emerging-threats

View on GitHub