Sagan high stable other

[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[LINUX-POLKIT] POSSIBLE POLKIT PRIVILEGE ESCALATION ATTEMPT (CVE-2021-4034)"; content: "chmod"; content:"a
| 2b
| x";distance: 1; content:"
| 27
| GCONV_PATH
| 3d
| ";distance:1;nocase; threshold: type suppress, track by_src, count 1, seconds 300;classtype: exploit-attempt; reference: url,github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c; sid:5005963; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...