linux

CVE-2021-3156 Exploitation Attempt

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing required to trigger the heap-based buffer overflow.

CVE-2021-3156 Exploitation Attempt Bruteforcing

Apr 21, 2023 · attack.privilege_escalation attack.t1068 cve.2021.3156 ·

Share on:

Detects exploitation attempt of vulnerability described in CVE-2021-3156. Alternative approach might be to look for flooding of auditd logs due to bruteforcing. required to trigger the heap-based buffer overflow.

Failed Logins with Different Accounts from Single Source - Linux

Apr 21, 2023 · attack.credential_access attack.t1110 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

OMIGOD SCX RunAsProvider ExecuteScript

Apr 21, 2023 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Privilege Escalation Preparation

Apr 21, 2023 · attack.execution attack.t1059.004 ·

Share on:

Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.