Sigma rule: Potential Exploitation of CVE-2025-5054 or CVE-2025-4598

Rule

Title

Potential Exploitation of CVE-2025-5054 or CVE-2025-4598

Status

experimental

Level

medium

Author

Milad Cheraghi

Date

2026-04-28

File

rules-emerging-threats/2025/Exploits/CVE_2025_4598/proc_creation_lnx_exploit_cve_2025_5054_or_cve_2025_4598.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

Log source

product

linux

category

process_creation

Detection

selection_suid_dumpable_sysctl:
    Image|endswith:
        - '/sbin/sysctl'
        - '/bin/sysctl'
    CommandLine|contains: 'fs.suid_dumpable='
selection_echo_proc_write:
    Image|endswith:
        - '/bin/bash'
        - '/bin/sh'
    CommandLine|contains:
        - 'echo 1 > /proc/sys/fs/suid_dumpable'
        - 'echo 2 > /proc/sys/fs/suid_dumpable'
        - 'echo 1 >/proc/sys/fs/suid_dumpable'
        - 'echo 2 >/proc/sys/fs/suid_dumpable'
        - 'echo 1> /proc/sys/fs/suid_dumpable'
        - 'echo 2> /proc/sys/fs/suid_dumpable'
        - 'echo 1>/proc/sys/fs/suid_dumpable'
        - 'echo 2>/proc/sys/fs/suid_dumpable'
condition: 1 of selection_*

False positives (as the rule lists them)

• System administrators enabling debugging temporarily
• Legitimate crash diagnostic operations

Tags

• attack.privilege-escalation
• attack.credential-access
• attack.t1548
• attack.t1003
• cve.2025-5054
• cve.2025-4598
• detection.emerging-threats

CVEs this rule names

• CVE-2025-4598
• CVE-2025-5054

MITRE ATT&CK ids this rule names

• T1003
• T1548

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-5054
• https://nvd.nist.gov/vuln/detail/CVE-2025-4598
• https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE_2025_4598/proc_creation_lnx_exploit_cve_2025_5054_or_cve_2025_4598.yml