Nimbuspwn Exploitation

Title: Nimbuspwn Exploitation
Status: test
Description:Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)
References:
  -https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
  -https://github.com/Immersive-Labs-Sec/nimbuspwn
Author: Bhabesh Raj
Date: 2022-05-04
modified:2023-01-23
Tags:

• -'attack.privilege-escalation'
• -'attack.t1068'

Logsource:

• product: linux

Detection:
  keywords:
    |all:
      -'networkd-dispatcher'
      -'Error handling notification for interface'
      -'../../'

  condition:keywords
Falsepositives:
  -Unknown
Level: high