Linux Kernel cgroup v1 release_agent Privilege Escalation (CVE-2022-0492)

union
(
    DeviceProcessEvents
    | where FileName in~ ("sh", "bash", "dash") or ProcessCommandLine has_any ("/sys/fs/cgroup", "release_agent", "notify_on_release")
    | where ProcessCommandLine has_any ("release_agent", "notify_on_release", "/sys/fs/cgroup")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, ParentProcessName=InitiatingProcessFileName
),
(
    DeviceFileEvents
    | where FolderPath has "/sys/fs/cgroup"
    | where FileName in~ ("release_agent", "notify_on_release")
    | where ActionType in ("FileModified", "FileCreated")
    | project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, ActionType, InitiatingProcessCommandLine
),
(
    DeviceProcessEvents
    | where InitiatingProcessCommandLine has_any ("unshare", "nsenter") and ProcessCommandLine has "/sys/fs/cgroup"
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
)
| extend AlertDetail = "Potential CVE-2022-0492 cgroup v1 release_agent exploitation"
| order by TimeGenerated desc

index=linux_security sourcetype IN ("sysmon_linux", "auditd", "osquery")
(
  (EventCode=11 OR event_type="WRITE" OR event_type="OPEN")
  TargetFilename IN ("/sys/fs/cgroup/*/release_agent", "/sys/fs/cgroup/memory/release_agent", "/sys/fs/cgroup/cpu/release_agent")
)
OR
(
  (EventCode=1 OR event_type="execve")
  (
    (process IN ("sh","bash","dash") CommandLine="*release_agent*")
    OR (process IN ("unshare","nsenter") CommandLine="*/sys/fs/cgroup*")
    OR CommandLine="*notify_on_release*"
  )
)
| eval risk_score=case(
    match(TargetFilename,"release_agent"), 95,
    match(CommandLine,"unshare.*cgroup"), 85,
    true(), 70
  )
| eval cve="CVE-2022-0492"
| table _time, host, user, process, CommandLine, TargetFilename, risk_score, cve
| sort -risk_score

sequence by host.id with maxspan=2m
  [
    process where event.type == "start" and
    (
      process.name in ("unshare", "nsenter") or
      process.args : ("/sys/fs/cgroup*", "*release_agent*", "*notify_on_release*")
    )
  ] by process.pid
  [
    file where event.action in ("creation", "overwrite") and
    file.path : "/sys/fs/cgroup/*/release_agent"
  ] by process.pid
  [
    process where event.type == "start" and
    process.parent.name in ("runc", "containerd-shim", "sh", "bash")
    and process.user.id == "0"
  ] by process.parent.pid

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "processname",
  "cmdline",
  "filepath",
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux', 'Syslog', 'SysmonLinux')
  AND (
    (LOWER("filepath") LIKE '/sys/fs/cgroup/%release_agent%')
    OR (LOWER("cmdline") LIKE '%release_agent%')
    OR (LOWER("cmdline") LIKE '%notify_on_release%')
    OR (
      LOWER("processname") IN ('unshare', 'nsenter')
      AND LOWER("cmdline") LIKE '%cgroup%'
    )
  )
  AND QIDNAME(qid) NOT IN ('Container Runtime Management', 'Kubernetes Lifecycle')
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=linux* OR _sourceCategory=auditd OR _sourceCategory=sysmon
| where (%"filepath" matches "/sys/fs/cgroup/*/release_agent"
  OR %"cmdline" matches "*release_agent*"
  OR %"cmdline" matches "*notify_on_release*"
  OR (%"process" in ("unshare", "nsenter") and %"cmdline" matches "*cgroup*"))
| eval severity = if(%"filepath" matches "*release_agent*", "CRITICAL", "HIGH")
| eval cve = "CVE-2022-0492"
| count by _sourceHost, %"user", %"process", %"cmdline", %"filepath", severity, cve
| order by _count desc

rule cve_2022_0492_cgroup_release_agent {
  meta:
    author = "df00tech"
    description = "Detects CVE-2022-0492 cgroup v1 release_agent exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2022-0492"
    mitre_attack = "T1611"

  events:
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH" and
      (
        $e1.principal.process.file.full_path = /unshare|nsenter/ and
        $e1.principal.process.command_line = /cgroup/
      ) or
      (
        $e1.principal.process.command_line = /release_agent|notify_on_release/
      )
    ) or
    (
      $e1.metadata.event_type = "FILE_MODIFICATION" and
      $e1.target.file.full_path = /\/sys\/fs\/cgroup\/.+\/release_agent/
    )

  condition:
    $e1
}

#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, WriteFile)
| where
  (
    FileName IN ("unshare", "nsenter", "sh", "bash", "dash")
    AND CommandLine = ~"*release_agent*"
  )
  OR
  (
    CommandLine = ~"*notify_on_release*"
  )
  OR
  (
    TargetFileName = ~/\/sys\/fs\/cgroup\/.+\/release_agent/
  )
  OR
  (
    FileName IN ("unshare", "nsenter")
    AND CommandLine = ~"*/sys/fs/cgroup*"
  )
| eval ThreatScore = case(
    TargetFileName = ~/release_agent/, 95,
    FileName IN ("unshare","nsenter") AND CommandLine = ~"*cgroup*", 85,
    true(), 70
  )
| eval CVE = "CVE-2022-0492"
| table _time, ComputerName, UserName, FileName, CommandLine, TargetFileName, ThreatScore, CVE
| sort -ThreatScore