action: global
title: CVE-2021-3156 Exploitation Attempt
status: experimental
description: Detects exploitation attempt of vulnerability described in CVE-2021-3156. |
             Alternative approach might be to look for flooding of auditd logs due to bruteforcing |
             required to trigger the heap-based buffer overflow.
author: Bhabesh Raj
date: 2021/02/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3156
    - https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
    - https://nvd.nist.gov/vuln/detail/cve-2021-3156
falsepositives:
    - Unknown
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
logsource:
    product: linux
    service: auditd
---
id: 5ee37487-4eb8-4ac2-9be1-d7d14cdc559f
detection:
    selection:
        type: 'EXECVE'
        a0: '/usr/bin/sudoedit'
    cmd1:
        a1: '-s'
    cmd2:
        a2: '-s'
    cmd3:
        a3: '-s'
    cmd4:
        a4: '-s'
    cmd5:
        a1: '\'
    cmd6:
        a2: '\'
    cmd7:
        a3: '\'
    cmd8:
        a4: '\'
    condition: selection and (cmd1 or cmd2 or cmd3 or cmd4) and (cmd5 or cmd6 or cmd7 or cmd8) | count() by host > 50
---
id: b9748c98-9ea7-4fdb-80b6-29bed6ba71d2
detection:
    selection:
        type: 'SYSCALL'
        exe: '/usr/bin/sudoedit'
    condition: selection | count() by host > 50
