rule: sudo priv esc vuln CVE-2019-14287

rules/linux/lnx_sudo_cve_2019_14287.yml

@@ -0,0 +1,18 @@
+title: Sudo Privilege Escalation CVE-2019-14287
+status: experimental
+description: Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287
+references:
+    - https://access.redhat.com/security/cve/cve-2019-14287
+    - https://twitter.com/matthieugarin/status/1183970598210412546
+author: Florian Roth
+date: 2019/10/15
+logsource:
+    product: linux
+detection:
+    keywords:
+        - '* -u#-1*'
+        - '* -u#4294967295*'
+    condition: keywords
+falsepositives:
+    - Unlikely
+level: critical