rule: updated sudo vuln rule to detect 0-padding

https://twitter.com/taviso/status/1184238670343065600
This commit is contained in:
Florian Roth 2019-10-16 15:03:28 +02:00
parent c396526f40
commit 5374d18e4b

View File

@ -22,12 +22,15 @@ level: critical
detection:
selection_keywords:
- '* -u#-1*'
- '* -u#-01*'
- '* -u#-001*'
- '* -u#-000*'
- '* -u#4294967295*'
condition: selection_keywords
---
detection:
selection_user:
USER:
- '#-1'
- '#-*'
- '#4294967295'
condition: selection_user