Elastic Defend high stable eql

CVE-2023-0386 Exploitation Attempt

Detects an attempt to exploit the CVE-2023-0386 local privilege escalation vulnerability.

Detection Logic

process where event.type == "start" and event.action == "exec" and 
    process.name : "fusermount*" and 
    process.args : "-o" and 
    process.args : "rw,nosuid,nodev" and 
    process.args : "./*" and 
    process.parent.name : "fuse"

Field Validations

Loading…

Comments (0)

Loading comments...