Enterprise EDR: Can Enterprise EDR detect CVE-2021-3156 being exploited

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Can Enterprise EDR detect exploit of CVE-2021-3156? 

Environment

• Enterprise EDR (was CB ThreatHunter)

Resolution

Yes, use the following search which can also be added as a watchlist: 
 

cmdline:sudoedit (cmdline:"-s" OR cmdline:"-i")

Additional Information

CVE-2021-3156 identifies an exploit in the sudo library provided by the underlying OS that allows privilege escalation to root via a heap-based buffer overflow.  Any linux server running a version of sudo prior to 1.9.5p2 is vulnerable.