Elastic Defend high stable eql
Potential Privilege Escalation via Fuse Binary
This rule identifies the execution of the "fuse" binary by the root user, excluding cases where the user's group is not root or the parent process is sudo. Such behavior is likely considered anomalous and may suggest an attempt at privilege escalation, potentially leveraging the CVE-2023-0386 vulnerability.
Detection Logic
process where event.type == "start" and event.action == "exec" and
process.parent.name == "fuse" and process.name == "fusermount" and
user.id == 0 and not (group.id == 0 or process.name == "sudo")Field Validations
Loading…
Comments (0)
Loading comments...