Linux-DynoRoot-CVE-2018-1111

Description

The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit a DHCP remote code command injection CVE-2018-1111. DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7. Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges. CVE: CVE-2018-1111. Read more here:. Https://access.redhat.com/security/cve/cve-2018-1111. Https://www.cvedetails.com/cve/CVE-2018-1111. Tags: #exploit #CVE-2018-1111 #DynoRoot.

Query · kql

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "/etc/NetworkManager/dispatcher.d/"
    and InitiatingProcessCommandLine contains "-dhclient"
    and isnotempty(ProcessCommandLine)
    and FileName !endswith ".exe"
| project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine
Raw source Linux-DynoRoot-CVE-2018-1111 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 445a1251-b7ad-44db-8b86-51d79b34e726
name: Linux-DynoRoot-CVE-2018-1111
description: |
  The query checks process command lines arguments and parent/child combinations to find machines where there have been.
  Attempts to exploit a DHCP remote code command injection CVE-2018-1111.
  DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
  Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
  CVE: CVE-2018-1111.
  Read more here:.
  Https://access.redhat.com/security/cve/cve-2018-1111.
  Https://www.cvedetails.com/cve/CVE-2018-1111.
  Tags: #exploit #CVE-2018-1111 #DynoRoot.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where InitiatingProcessCommandLine contains "/etc/NetworkManager/dispatcher.d/"
      and InitiatingProcessCommandLine contains "-dhclient"
      and isnotempty(ProcessCommandLine)
      and FileName !endswith ".exe"
  | project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.