Elastic Defend high stable eql

Sudo Heap-Based Buffer Overflow Attempt

Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.

View Source

Detection Logic

process where event.action == "exec" and
  process.name in ("sudoedit", "sudo") and
  process.args in ("-s", "-S") and process.args : "sudoedit" and process.args : "*\\"

Field Validations

Loading…

Comments (0)

Loading comments...