Elastic Defend high stable eql

Privilege Escalation via PKEXEC Exploitation

Identifies attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.

View Source

Detection Logic

file where event.action != "deletion" and
process.executable like ("/tmp/*", "/dev/shm/*", "/var/tmp/*", "/root/*", "/home/*", "./*", "/boot/*") and
file.path like~ "/*GCONV_PATH*"

Field Validations

Loading…

Comments (0)

Loading comments...