-
Potential CVE-2025-32463 Nsswitch File Creation
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Defend Data Source: SentinelOne Data Source: Crowdstrike Data Source: Elastic Endgame Data Source: Auditd Manager Use Case: Vulnerability Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2025-32463 ·Detects suspicious creation of the nsswitch.conf file, outside of the regular /etc/nsswitch.conf path, consistent with attempts to exploit CVE-2025-32463 (the "sudo chroot" privilege escalation), where an attacker tricks sudo into using attacker-controlled NSS files or libraries to gain root.
Read More -
Potential CVE-2025-32463 Sudo Chroot Execution Attempt
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Defend Data Source: SentinelOne Data Source: Crowdstrike Data Source: Elastic Endgame Data Source: Auditd Manager Use Case: Vulnerability Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2025-32463 ·Detects suspicious use of sudo's --chroot / -R option consistent with attempts to exploit CVE-2025-32463 (the "sudo chroot" privilege escalation), where an attacker tricks sudo into using attacker-controlled NSS files or libraries to gain root.
Read More