legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. filter based on known administrative activity and verified system processes.

splunk

Techniques

Sample rules

Linux Possible Nimbuspwn Privilege Escalation

source: splunk
technicques:

Description

The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service. Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process="*networkd-dispatcher*"
Processes.process="*../*"

by Processes.process Processes.vendor_product Processes.user_id
   Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
   Processes.action Processes.dest Processes.process_current_directory Processes.process_path
   Processes.process_integrity_level Processes.original_file_name Processes.parent_process
   Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
   Processes.process_guid Processes.process_id Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `linux_possible_nimbuspwn_privilege_escalation_filter`