Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)

rule: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
desc: 'This rule detects attempts to exploit a privilege escalation vulnerability
  in Polkit''s pkexec. Through the execution of specially crafted code, a local user
  can exploit this weakness to attain root privileges on a compromised system. This
  rule is highly specific in its scope.

  '
condition: spawned_process and user.loginuid != 0 and proc.name=pkexec and proc.args
  = ''
output: Detect Polkit pkexec Local Privilege Escalation Exploit (CVE-2021-4034) |
  args=%proc.args evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- users
- mitre_privilege_escalation
- TA0004