Linux-DynoRoot-CVE-2018-1111.txt

// The query checks process command lines arguments and parent/child combinations to find machines where there have been 
// attempts to exploit a DHCP remote code command injection CVE-2018-1111.
// DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
// Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
//
// CVE: CVE-2018-1111
// Read more here:
// https://access.redhat.com/security/cve/cve-2018-1111
// https://www.cvedetails.com/cve/CVE-2018-1111/
//
// Tags: #exploit #CVE-2018-1111 #DynoRoot

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "/etc/NetworkManager/dispatcher.d/"
    and InitiatingProcessCommandLine contains "-dhclient"
    and isnotempty(ProcessCommandLine)
    and FileName !endswith ".exe"
| project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine