cscli scenarios install crowdsecurity/CVE-2021-4034Detects exploit of CVE-2021-4034 pkexec vulnerability.
⚠️ Smart attackers can exploit this vulnerability without leaving traces in logs
1type: trigger2#debug: true3name: crowdsecurity/CVE-2021-40344description: "Detect CVE-2021-4034 exploits"5filter: evt.Meta.log_type == 'CVE-2021-4034-xpl'6groupby: evt.Meta.target_user7blackhole: 1m8labels:9 type: privesc10 classification:11 - attack.T154812 - cve.CVE-2021-403413 behavior: "generic:exploit"14 spoofable: 015 confidence: 316 service: linux17 label: "`pkexec` CVE-2021-4034"18scope:19 type: system_account20 expression: evt.Meta.target_user21