apply suggestions

Author: swachchhanda000

rules-emerging-threats/2025/Exploits/CVE-2025-32463/file_event_lnx_exploit_cve_2025_32463.yml

@@ -21,9 +21,9 @@ logsource:
 detection:
     selection:
         TargetFilename|endswith: '/etc/nsswitch.conf'
-    filter:
+    filter_main_legitimate_path:
         TargetFilename: '/etc/nsswitch.conf'
-    condition: selection and not filter
+    condition: selection and not 1 of filter_main_*
 falsepositives:
     - Backup locations
 level: high

…_creation_lnx_exploit_cve_2025_32463.yml …n/proc_creation_lnx_chroot_execution.ymlrules-emerging-threats/2025/Exploits/CVE-2025-32463/proc_creation_lnx_exploit_cve_2025_32463.yml renamed to rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml rules-emerging-threats/2025/Exploits/CVE-2025-32463/proc_creation_lnx_exploit_cve_2025_32463.yml renamed to rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml

@@ -1,18 +1,16 @@
-title: Potential Sudo Chroot CVE-2025-32463 Vulnerability Exploitation
+title: Ch
 id: f2bed782-994e-4f40-9cd5-518198cb3fba
 status: experimental
 description: |
-    Detects the use of sudo with the '--chroot' or '-R' options which could indicate a potential attempt to exploit CVE-2025-32463.
-    This is a local privilege escalation vulnerability in sudo 1.9.14 to 1.9.17 that allows loading arbitrary shared libraries from a user-controlled directory.
+    Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
+    Attackers may use this technique to evade detection and execute commands in a modified environment.
 references:
     - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
 author: Swachchhanda Shrawn Poudel (Nextron Systems)
 date: 2025-10-02
 tags:
     - attack.privilege-escalation
     - attack.t1068
-    - cve.2025-32463
-    - detection.emerging-threats
 logsource:
     category: process_creation
     product: linux
@@ -25,4 +23,4 @@ detection:
     condition: selection
 falsepositives:
     - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.
-level: medium
+level: low