feat: add detection rules for CVE-2025-32463 sudo chroot vulnerability

[swachchhanda000]

Summary of the Pull Request

Changelog

new: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
new: Linux Sudo Chroot Execution

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[phantinuss]

the sudo execution with -R/--chroot is a bit iffy but it also shouldn't be that common in general. I am fine to try it as level: medium

[Copilot]

Pull Request Overview

This PR adds detection rules for CVE-2025-32463, a local privilege escalation vulnerability in sudo versions 1.9.14 to 1.9.17 that allows loading arbitrary shared libraries from user-controlled directories during chroot operations.

• Adds process creation detection for sudo commands using --chroot or -R options
• Adds file event detection for nsswitch.conf creation in non-standard directories
• Provides detection coverage for two different attack vectors of the same CVE

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
proc_creation_lnx_exploit_cve_2025_32463.yml	Detects sudo commands with chroot options that could indicate exploitation attempts
file_event_lnx_exploit_cve_2025_32463.yml	Detects creation of nsswitch.conf files in non-standard locations

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[swachchhanda000]

the sudo execution with -R/--chroot is a bit iffy but it also shouldn't be that common in general. I am fine to try it as level: medium

maybe it could be a general rule --chroot execution with user-writeable paths like '/tmp' et.

[phantinuss]

the sudo execution with -R/--chroot is a bit iffy but it also shouldn't be that common in general. I am fine to try it as level: medium

maybe it could be a general rule --chroot execution with user-writeable paths like '/tmp' et.

only really necessary if that results in a rule of level: high or higher. I am not so sure about that or that it's worth it tbh.

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}