Linux sudo CVE-2019-14287 exploit attempt via suspicious USER value patterns

title: Linux sudo CVE-2019-14287 exploit attempt via suspicious USER value patterns
id: 2a888fdb-4b0e-4125-ac53-43bfd2609fd2
related:
  - id: f74107df-b6c6-4e80-bf00-4170b658162b
    type: derived
  - id: 7fcc54cb-f27d-4684-84b7-436af096f858
    type: derived
status: test
description: This rule flags Linux sudo activity where the USER field matches specific suspicious patterns associated with attempted exploitation of CVE-2019-14287. Attackers may use crafted inputs to trigger a sudo privilege-escalation vulnerability and gain elevated rights. The detection relies on sudo telemetry capturing the USER field in auth/log events.
references:
  - https://www.openwall.com/lists/oss-security/2019/10/14/1
  - https://access.redhat.com/security/cve/cve-2019-14287
  - https://twitter.com/matthieugarin/status/1183970598210412546
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-14287/lnx_sudo_exploit_cve_2019_14287.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-15
modified: 2022-11-26
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1548.003
  - cve.2019-14287
  - detection.emerging-threats
logsource:
  product: linux
  service: sudo
detection:
  selection_user:
    USER:
      - "#-*"
      - "#*4294967295"
  condition: selection_user
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1