Elastic high deprecated kql

Deprecated - Sudo Heap-Based Buffer Overflow Attempt

Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.

View Source

Detection Logic

event.category:process and event.type:start and
  process.name:(sudo or sudoedit) and
  process.args:(*\\ and ("-i" or "-s"))

False Positives

⚠ This rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the Sudo or Sudoedit binaries. Only Sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.

Field Validations

Loading…

Comments (0)

Loading comments...