Linux: Nimbuspwn path traversal attempts targeting networkd-dispatcher

title: "Linux: Nimbuspwn path traversal attempts targeting networkd-dispatcher"
id: 30440fd8-6ab7-43d8-b88f-07e4d0c3efb3
status: test
description: This rule flags Linux events containing the networkd-dispatcher error handling notification text along with a directory traversal marker ('../..'). Such patterns can indicate attempts to trigger Nimbuspwn-related privilege escalation behavior by manipulating how files are referenced during processing. It relies on keyword matches in Linux telemetry to identify the specific strings associated with this attempt.
references:
  - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
  - https://github.com/Immersive-Labs-Sec/nimbuspwn
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-29799/lnx_exploit_cve_2022_27999_cve_2022_27800.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-05-04
modified: 2025-11-03
tags:
  - attack.privilege-escalation
  - attack.t1068
  - detection.emerging-threats
  - cve.2022-29799
  - cve.2022-27800
logsource:
  product: linux
detection:
  keywords:
    "|all":
      - networkd-dispatcher
      - Error handling notification for interface
      - ../../
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7ba05b43-adad-4c02-b5e9-c8c35cdf9fa8
    type: derived