Threat video1:00
sudo iptables LPE via Comment Newlines: Detection & IOCs
Sudo rights on iptables let a low-privileged user forge a passwd entry and reach root. It adds 9 detection rules, 6 IOCs and a free Splunk SPL rule.
Read the full threat intel for sudo iptables LPE via Comment Newlines: Detection & IOCs →
Chapters
- 0:00The hookIptables misconfiguration: two paths to root.
- 0:04The storyModprobe and comment injection enable escalation.
- 0:10Attack pathSudo grant on iptables opens two escalation paths.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise2 indicators to hunt: 2 paths.
- 0:34MITRE ATT&CK techniques9 ATT&CK techniques, from execution to impact.
- 0:39Remediation3 steps now: Audit /etc/sudoers and /etc/sudoers.d/* for any rule granting iptables, iptables-save.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Iptables misconfiguration: two paths to root.
0:05Modprobe and comment injection enable escalation.
0:11Sudo grant on iptables opens two escalation paths.
0:14Modprobe script execution; comment newline injection both reach root.
0:19Both grant root access or interactive shell.
0:25No threat actor is attributed. Confidence: low.
0:292 indicators to hunt: 2 paths.
0:359 ATT&CK techniques, from execution to impact.
0:393 steps now: Audit /etc/sudoers and /etc/sudoers.d/* for any rule granting iptables, iptables-save.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.