Emerging Threathightest

Sudo Privilege Escalation CVE-2019-14287

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Tue Oct 15Updated Wed Oct 05f74107df-b6c6-4e80-bf00-4170b658162b2019

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains: ' -u#'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation

Techniques

T1068 · Exploitation for Privilege Escalation

Sub-techniques

T1548.003 · Sudo and Sudo Caching

Other

cve.2019-14287detection.emerging-threats

Rule Metadata

Rule ID

f74107df-b6c6-4e80-bf00-4170b658162b

Status

test

Level

high

Type

Emerging Threat

Created

Tue Oct 15

Modified

Wed Oct 05

Author

Florian Roth (Nextron Systems)

Path

rules-emerging-threats/2019/Exploits/CVE-2019-14287/proc_creation_lnx_exploit_cve_2019_14287.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1068attack.t1548.003cve.2019-14287detection.emerging-threats

View on GitHub