CVE-2015-5287: Red Hat ABRT sosreport Local Privilege Escalation

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("abrtd", "abrt-hook-ccpp", "abrt-action-install-debuginfo", "sosreport")
| where ProcessCommandLine has_any ("/bin/sh", "/bin/bash", "bash -i", "sh -c", "python -c", "chmod +s", "cp /bin/sh")
| where AccountName in~ ("root", "abrt")
| where InitiatingProcessAccountName !in~ ("root")
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

index=linux (sourcetype=linux_audit OR sourcetype=syslog OR sourcetype="linux:execve")
| eval proc=coalesce(exe, comm, process)
| search (parent_process=abrtd OR parent_process="abrt-hook-ccpp" OR parent_process="abrt-action-install-debuginfo" OR parent_process=sosreport)
| where like(process, "%/bin/sh%") OR like(process, "%/bin/bash%") OR like(process, "%sh -c%") OR like(process, "%chmod +s%") OR like(process, "%cp /bin/sh%")
| where user="root" AND parent_user!="root"
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, parent_user, parent_process, process
| convert ctime(firstTime) ctime(lastTime)

process where event.type == "start" and
  process.parent.name in ("abrtd", "abrt-hook-ccpp", "abrt-action-install-debuginfo", "sosreport") and
  process.name in ("sh", "bash", "dash", "python", "python2", "chmod", "cp") and
  user.name == "root" and process.parent.user.name != "root"

SELECT QIDNAME(qid) AS event, sourceip, username, "ParentProcessName", "ProcessName", "CommandLine"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%'
AND "ParentProcessName" IN ('abrtd','abrt-hook-ccpp','abrt-action-install-debuginfo','sosreport')
AND ("CommandLine" ILIKE '%/bin/sh%' OR "CommandLine" ILIKE '%/bin/bash%' OR "CommandLine" ILIKE '%chmod +s%' OR "CommandLine" ILIKE '%cp /bin/sh%')
AND username = 'root'
LAST 24 HOURS

_sourceCategory=*linux* ("abrtd" OR "abrt-hook-ccpp" OR "abrt-action-install-debuginfo" OR "sosreport")
| parse "ppid=* " as parent_process nodrop
| parse "comm=\"*\"" as process nodrop
| parse "uid=*" as uid nodrop
| where (process matches "*sh*" or process matches "*chmod*" or process matches "*cp*")
| where uid = "0"
| count by _sourceHost, parent_process, process, uid

rule cve_2015_5287_abrt_sosreport_privesc {
  meta:
    author = "argus"
    description = "Detects CVE-2015-5287 ABRT sosreport local privilege escalation via root shell spawned by abrt components"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /.*(abrtd|abrt-hook-ccpp|abrt-action-install-debuginfo|sosreport).*/
    $e.target.process.command_line = /.*(\/bin\/sh|\/bin\/bash|chmod \+s|cp \/bin\/sh).*/
    $e.principal.user.userid = "root"
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(abrtd|abrt-hook-ccpp|abrt-action-install-debuginfo|sosreport)$/
| CommandLine=/(\/bin\/sh|\/bin\/bash|chmod \+s|cp \/bin\/sh)/i
| UID="0"
| table([timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])