PwnKit Local Privilege Escalation

Title: PwnKit Local Privilege Escalation
Status: test
Description:Detects potential PwnKit exploitation CVE-2021-4034 in auth logs
References:
  -https://twitter.com/wdormann/status/1486161836961579020
Author: Sreeman
Date: 2022-01-26
modified:2024-09-11
Tags:

• -'attack.defense-evasion'
• -'attack.privilege-escalation'
• -'attack.t1548.001'

Logsource:

• product: linux
• service: auth

Detection:
  keywords:
    |all:
      -'pkexec'
      -'The value for environment variable XAUTHORITY contains suspicious content'
      -'[USER=root] [TTY=/dev/pts/0]'

  condition:keywords
Falsepositives:
  -Unknown
Level: high