[LINUX-POLKIT] POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[LINUX-POLKIT] POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)"; content: "PATH
| 3d 2f
| usr
| 2f
| local
| 2f
| sbin
| 3a 2f
| usr
| 2f
| local
| 2f
| bin
| 3a 2f
| usr
| 2f
| sbin
| 3a 2f
| usr
| 2f
| bin
| 3a 2f
| sbin
| 3a 2f
| bin
| 3a 2f
| opt
| 2f
| bin
| 22 2c
| "; content:"NULL";distance: 1; within: 50; nocase; classtype: exploit-attempt; reference: url,github.com/berdav/CVE-2021-4034/blob/main/pwnkit.c; sid:5005965; rev:2;)