update: description

Author: swachchhanda000

rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml

@@ -4,6 +4,8 @@ status: experimental
 description: |
     Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
     Attackers may use this technique to evade detection and execute commands in a modified environment.
+    This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
+    While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
 references:
     - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
 author: Swachchhanda Shrawn Poudel (Nextron Systems)