Detection rules › Sigma
Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1068 Exploitation for Privilege Escalation |
Event coverage
| Provider | Event |
|---|---|
| Sysmon-for-Linux | Event ID 11 |
Rule body yaml
title: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
id: 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
status: experimental
description: |
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
references:
- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
author: Swachchhanda Shrawn Poudel (Nextron Systems)
date: 2025-10-02
modified: 2026-03-31
tags:
- attack.privilege-escalation
- attack.t1068
- cve.2025-32463
- detection.emerging-threats
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith: '/etc/nsswitch.conf'
filter_main_legitimate_path:
TargetFilename:
- '/etc/nsswitch.conf'
- '/usr/share/factory/etc/nsswitch.conf'
condition: selection and not 1 of filter_main_*
falsepositives:
- Backup locations
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
TargetFilename|endswith: '/etc/nsswitch.conf'
Stage 2: not filter_main_legitimate_path
filter_main_legitimate_path:
TargetFilename:
- '/etc/nsswitch.conf'
- '/usr/share/factory/etc/nsswitch.conf'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TargetFilename | eq | /etc/nsswitch.conf |
TargetFilename | eq | /usr/share/factory/etc/nsswitch.conf |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetFilename | ends_with |
|