[LINUX-POLKIT] POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[LINUX-POLKIT] POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)"; content: "export PATH
| 3d 2f
| usr
| 2f
| local
| 2f
| sbin
| 3a 2f
| usr
| 2f
| local
| 2f
| bin
| 3a 2f
| usr
| 2f
| sbin
| 3a 2f
| usr
| 2f
| bin
| 3a 2f
| sbin
| 3a 2f
| bin
| 3b
| "; content:"rm -rf";nocase;distance: 1; content:"
| 27
| GCONV_PATH
| 3d 2e 27
| ";distance:1;nocase;threshold: type suppress, track by_src, count 1, seconds 300; classtype: exploit-attempt; reference: url,github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c; sid:5005964; rev:2;)