Potential Privilege Escalation via OverlayFS

[rule]
description = """
Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and CVE-2023-32629) via a flaw in Ubuntu's
modifications to OverlayFS. These flaws allow the creation of specialized executables, which, upon execution, grant the
ability to escalate privileges to root on the affected machine.
"""
id = "ca9de348-a09d-4c67-af21-5645b70003d0"
license = "Elastic License v2"
name = "Potential Privilege Escalation via OverlayFS"
os_list = ["linux"]
reference = [
    "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability",
    "https://twitter.com/liadeliyahu/status/1684841527959273472",
]
version = "1.0.9"

query = '''
sequence by process.parent.entity_id with maxspan=5s
  [process where event.action == "exec" and event.type == "start" and 
    process.name == "unshare" and process.args in ("-r", "-rm", "-m") and process.args : "*cap_setuid*"  and user.id != 0]
  [process where event.action == "uid_change" and event.type == "change" and user.id == 0]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"