Sudo Potential Privilege Escalation

rule: Sudo Potential Privilege Escalation
desc: 'Affecting sudo (<= 1.9.5p2), there''s a privilege escalation vulnerability.
  By executing sudo using the sudoedit -s or sudoedit -i command with a command-line
  argument that ends with a single backslash character, an unprivileged user can potentially
  escalate privileges to root. This rule is highly specific and might be bypassed
  due to potential issues with string matching on command line arguments.

  '
condition: 'spawned_process and user.loginuid != 0 and (proc.name=sudoedit or proc.name
  = sudo) and (proc.args contains -s or proc.args contains -i or proc.args contains
  --login) and (proc.args contains "\ " or proc.args endswith \)

  '
output: Detect Sudo Privilege Escalation Exploit (CVE-2021-3156) | evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- filesystem
- users
- mitre_privilege_escalation
- T1548.003