Sagan high stable other

[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)"; content: "mkdir -p";nocase; content:"
| 27
| GCONV_PATH
| 3D 2E 27
| ";distance: 1; nocase;threshold: type suppress, track by_src, count 1, seconds 300; classtype: exploit-attempt; reference: url,github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c; sid:5005962; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...