Linux: Alert on nsswitch.conf creation outside standard paths

title: "Linux: Alert on nsswitch.conf creation outside standard paths"
id: 1f06a049-8ff6-45ec-bff8-7b16f153f6b5
status: experimental
description: This rule flags file creation events where a target filename ends with /etc/nsswitch.conf but the path is not one of the known legitimate locations. Attackers may use this behavior to place a crafted nsswitch.conf in directories that can be used during privileged operations, potentially enabling malicious library loading and escalation. The detection relies on Linux file event telemetry capturing the created TargetFilename.
references:
  - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-32463/file_event_lnx_exploit_cve_2025_32463.yml
author: Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule Team
date: 2025-10-02
modified: 2026-03-31
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2025-32463
  - detection.emerging-threats
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith: /etc/nsswitch.conf
  filter_main_legitimate_path:
    TargetFilename:
      - /etc/nsswitch.conf
      - /usr/share/factory/etc/nsswitch.conf
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Backup locations
level: high
license: DRL-1.1
related:
  - id: 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
    type: derived