Detect Baron Samedit CVE-2021-3156

Status: experimental
Severity: medium
Author: Shannon Davis, Splunk
Source: github.com/splunk/security_content

The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \" command. This detection leverages logs from Linux systems, specifically searching for instances of the sudoedit command with the "-s" flag followed by a double quote. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows attackers to gain root privileges. If confirmed malicious, this could lead to complete system compromise, unauthorized access to sensitive data, and potential data breaches.

Known false positives

No false positives have been identified at this time.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Rule body

name: Detect Baron Samedit CVE-2021-3156
id: 93fbec4e-0375-440c-8db3-4508eca470c4
version: 9
creation_date: '2021-01-28'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \\" command. This detection leverages logs from Linux systems, specifically searching for instances of the sudoedit command with the "-s" flag followed by a double quote. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows attackers to gain root privileges. If confirmed malicious, this could lead to complete system compromise, unauthorized access to sensitive data, and potential data breaches.
data_source: []
search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs from the /var/log directory. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potential Baron Samedit behavior on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Baron Samedit CVE-2021-3156
asset_type: Endpoint
cve:
    - CVE-2021-3156
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

Stages and Predicates

Stage 1: `search`

`linux_hosts` "sudoedit -s \\"

Stage 2: `search`

| `detect_baron_samedit_cve_2021_3156_filter`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"sudoedit -s \\"`