cscli scenarios install crowdsecurity/auditd-suid-crashAttempt to detect a SUID binary that crashes with SIGILL, SIGTRAP, SIGABRT, SIGBUS, SIGSEGV.
It might be related to someone trying to exploit local privilege escalation such as CVE-2023-4911.
1type: conditional2name: crowdsecurity/auditd-suid-crash3description: "Detect root suid process crashing"4filter: |5 (evt.Meta.log_type == 'execve' && evt.Meta.euid == '0' && evt.Meta.auid != '0') ||6 (evt.Meta.log_type == 'anom_abend' && evt.Meta.sig in ["4", "5", "6", "7", "11"])7groupby: evt.Meta.pid8distinct: evt.Meta.log_type9condition: |10 len(queue.Queue) >= 2 and11 queue.Queue[0].Meta.exe == queue.Queue[1].Meta.exe12leakspeed: 1s13capacity: -114blackhole: 1m15labels:16 confidence: 117 spoofable: 018 classification:19 - attack.T1548.00420 behavior: "linux:exploitation"21 label: "Suspicious suid process crash"22 service: linux23 remediation: false24scope:25 type: exe26 expression: evt.Meta.exe27