Unprivileged Delegation of Page Faults Handling to a Userspace Process

rule: Unprivileged Delegation of Page Faults Handling to a Userspace Process
desc: 'Detect a successful unprivileged userfaultfd syscall, which could serve as
  an attack primitive for exploiting other vulnerabilities. To fine-tune this rule,
  consider using the template list "user_known_userfaultfd_processes".

  '
condition: 'evt.type = userfaultfd and user.uid != 0 and (evt.rawres >= 0 or evt.res
  != -1) and not proc.name in (user_known_userfaultfd_processes)

  '
output: An userfaultfd syscall was successfully executed by an unprivileged user |
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- mitre_defense_evasion
- TA0005