Potential CVE-2021-4034

id: '8621.11046'
title: Potential CVE-2021-4034
description: 'The Qualys Research Team has discovered a memory corruption vulnerability
  in polkit’s pkexec, a SUID-root program that is installed by default on every major
  Linux distribution. This use case looks for correlation of events for the execution
  of PoCs for CVE-2021-4034. - Threat Actor Association: Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type IN(path, syscall) "pkexec")
  OR type=bprm_fcaps | table _time, host, user src_ip, process_*, user, type, process
  `group_events(host, 2)` | where match(type, "(?i)path") and match(type, "(?i)syscall")
  and match(type, "(?i)bprm_fcaps") and match(process_path, "(?i)pkexec") '
techniques:
- privilege-escalation:abuse elevation control mechanism:setuid and setgid
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1548.001
- T1068
data_category:
- Linux audit logs
references:
- https://github.com/arthepsy/CVE-2021-4034
- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
- https://github.com/berdav/CVE-2021-4034/blob/main/pwnkit.c
- https://threatpost.com/linux-bug-in-all-major-distros-an-attackers-dream-come-true/177996/