mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
rule: updated sudo vuln rule to detect 0-padding
https://twitter.com/taviso/status/1184238670343065600
This commit is contained in:
parent
c396526f40
commit
5374d18e4b
@ -22,12 +22,15 @@ level: critical
|
||||
detection:
|
||||
selection_keywords:
|
||||
- '* -u#-1*'
|
||||
- '* -u#-01*'
|
||||
- '* -u#-001*'
|
||||
- '* -u#-000*'
|
||||
- '* -u#4294967295*'
|
||||
condition: selection_keywords
|
||||
---
|
||||
detection:
|
||||
selection_user:
|
||||
USER:
|
||||
- '#-1'
|
||||
- '#-*'
|
||||
- '#4294967295'
|
||||
condition: selection_user
|
Loading…
Reference in New Issue
Block a user