leviathan
9593d90385
Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.
Changes:
- All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
values, docs, comments)
- All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
- iamroot.c → skeletonkey.c
- modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
- tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
- Binary "iamroot" → "skeletonkey"
- GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
- .gitignore now expects build output named "skeletonkey"
- /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
- Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*
New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.
VERSION: 0.3.1 → 0.4.0 (breaking).
Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
title: Possible Dirty Pipe exploitation (CVE-2022-0847)
|
|
id: f6b13c08-skeletonkey-dirty-pipe
|
|
status: experimental
|
|
description: |
|
|
Detects file modifications to /etc/passwd, /etc/shadow, /etc/sudoers,
|
|
or /etc/sudoers.d/* by a non-root process. The Dirty Pipe primitive
|
|
is a page-cache write — the on-disk file is unchanged but the running
|
|
kernel sees the modified contents. This sigma rule complements the
|
|
auditd rules in detect/auditd.rules.
|
|
references:
|
|
- https://dirtypipe.cm4all.com/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-0847
|
|
author: SKELETONKEY
|
|
date: 2026/05/16
|
|
logsource:
|
|
product: linux
|
|
service: auditd
|
|
detection:
|
|
modification:
|
|
type: 'PATH'
|
|
name|startswith:
|
|
- '/etc/passwd'
|
|
- '/etc/shadow'
|
|
- '/etc/sudoers'
|
|
nametype:
|
|
- 'CREATE'
|
|
- 'NORMAL'
|
|
not_root:
|
|
auid|expression: '!= 0'
|
|
condition: modification and not_root
|
|
falsepositives:
|
|
- Legitimate package upgrades (`apt`, `dnf`, `dpkg`) — these run as
|
|
root so auid=0 excludes them
|
|
- Manual edits via `vipw`, `passwd`, etc. — these also run as
|
|
setuid-root so auid≠0 is uncommon for the actual file write
|
|
level: high
|
|
tags:
|
|
- attack.privilege_escalation
|
|
- attack.t1068
|
|
- cve.2022.0847
|