Linux Kernel Integer Overflow in create_elf_tables (CVE-2018-14634)

SecurityEvent
| where EventID == 4688
| where ProcessName endswith "bash" or ProcessName endswith "sh" or ProcessName endswith "python" or ProcessName endswith "perl"
| where CommandLine matches regex @"(?i)(execve|/proc/self/exe)"
| join kind=inner (
    SecurityEvent
    | where EventID == 4672
    | where PrivilegeList has "SeDebugPrivilege" or PrivilegeList has "SeTcbPrivilege"
    | project TimeGenerated, SubjectLogonId, PrivilegeList
) on $left.SubjectLogonId == $right.SubjectLogonId
| where TimeGenerated - TimeGenerated1 between (0min .. 5min)
| project TimeGenerated, Computer, Account, ProcessName, CommandLine, PrivilegeList
| where Account !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")

index=linux_audit sourcetype=linux_audit action=execve
| eval arg_count=mvcount(a0)
| where arg_count > 100
| join type=left uid [
    search index=linux_audit sourcetype=linux_audit syscall=setuid OR syscall=setreuid OR syscall=setresuid success=yes
    | where uid=0 OR euid=0
    | table uid, _time, syscall, euid
]
| where isnotnull(euid) AND euid=0
| stats count min(_time) as first_seen max(_time) as last_seen values(a0) as commands by uid, host
| where count > 0
| eval severity="critical"
| table _time, host, uid, commands, euid, severity

sequence by host.name, user.id with maxspan=5m
  [process where event.type == "start"
   and process.name in ("bash", "sh", "dash", "ksh", "zsh", "python", "python3", "perl")
   and length(process.args_count) > 0
   and process.args_count > 100]
  [process where event.type == "start"
   and user.effective.id == "0"
   and user.id != "0"
   and process.parent.name in ("bash", "sh", "dash", "ksh", "zsh", "python", "python3", "perl")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
       sourceip, username, "Process Name", "Command",
       QIDNAME(qid) as EventName
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Audit')
  AND ("syscall" = 'execve' OR "Process Name" IN ('bash','sh','dash','python','python3','perl','ksh','zsh'))
  AND username NOT IN ('root','daemon','nobody','www-data')
  AND sourceip IN
    (SELECT sourceip FROM events
     WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Audit')
       AND ("syscall" IN ('setuid','setreuid','setresuid') AND "euid" = '0')
       AND DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('minute', -5, NOW())
     GROUP BY sourceip)
GROUP BY sourceip, username, "Process Name", "Command"
HAVING COUNT(*) > 0
LAST 3600 SECONDS

_sourceCategory=linux/audit
| parse "syscall=* " as syscall
| parse "uid=* " as uid
| parse "euid=* " as euid
| parse "comm=\"*\"" as comm
| where syscall = "execve" and uid != "0"
| timeslice 5m
| join
  (_sourceCategory=linux/audit
  | parse "syscall=* " as syscall2
  | parse "uid=* " as uid2
  | parse "euid=* " as euid2
  | where (syscall2 = "setuid" or syscall2 = "setreuid" or syscall2 = "setresuid") and euid2 = "0"
  | timeslice 5m) on _timeslice, uid=uid2
| where uid != "0" and euid2 = "0"
| fields _timeslice, uid, comm, syscall, euid2
| count by uid, comm

rule cve_2018_14634_linux_privesc {
  meta:
    author = "df00tech"
    description = "Detects potential CVE-2018-14634 exploitation: integer overflow in create_elf_tables leading to local privilege escalation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.cve.org/CVERecord?id=CVE-2018-14634"

  events:
    $execve.metadata.event_type = "PROCESS_LAUNCH"
    $execve.principal.user.userid != "root"
    $execve.principal.user.userid != ""
    $execve.target.process.command_line != ""
    ($execve.target.process.file.full_path = /.*\/sh$/ or
     $execve.target.process.file.full_path = /.*\/bash$/ or
     $execve.target.process.file.full_path = /.*\/python.*/)

    $setuid.metadata.event_type = "PROCESS_LAUNCH"
    $setuid.principal.user.userid = "root"
    $setuid.principal.hostname = $execve.principal.hostname

    $execve.metadata.event_timestamp.seconds <= $setuid.metadata.event_timestamp.seconds
    $setuid.metadata.event_timestamp.seconds - $execve.metadata.event_timestamp.seconds <= 300

  condition:
    $execve and $setuid
}

event_simpleName=ProcessRollup2
| where UserName != "root" and UserName != ""
| where FileName in ("bash", "sh", "dash", "ksh", "zsh", "python", "python3", "perl")
| join type=inner (
    event_simpleName=ProcessRollup2
    | where UserIsAdmin=1 and UserName="root"
    | rename TargetProcessId as ChildRootPid, ParentProcessId as ChildParentPid
    | fields TargetProcessId, ChildParentPid, UserName, FileName, ComputerName, timestamp
) on $left.TargetProcessId==$right.ChildParentPid and $left.ComputerName==$right.ComputerName
| where timestamp - timestamp1 <= 300
| where platform_name="Linux"
| stats count by UserName, FileName, ComputerName, CommandLine
| where count > 0