admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-06-23 10:59:23 -07:00
committed by GitHub
parent 89d86a5fae f5aa3cb622
commit 89ba97cbda
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_baron_samedit_cve_2021_3156.yml
+1 -1
View File
@@ -7,7 +7,7 @@ status: experimental
type: TTP
description: This search detects the heap-based buffer overflow of sudoedit
data_source: []
search: '`linux_hosts` | search "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs
from the /var/log directory. The vulnerability is exposed when a non privledged
user tries passing in a single \ character at the end of the command while using
detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
+2 -2
View File
@@ -7,8 +7,8 @@ status: experimental
type: TTP
description: This search detects the heap-based buffer overflow of sudoedit
data_source: []
search: '`linux_hosts` | search sudoedit segfault | stats count min(_time) as firstTime
max(_time) as lastTime by host | search count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter`'
search: '`linux_hosts` TERM(sudoedit) TERM(segfault) | stats count min(_time) as firstTime
max(_time) as lastTime by host | where count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter`'
how_to_implement: Splunk Universal Forwarder running on Linux systems (tested on Centos
and Ubuntu), where segfaults are being logged. This also captures instances where
the exploit has been compiled into a binary. The detection looks for greater than