feat: add detection rules for CVE-2025-32463 sudo chroot vulnerability

rules-emerging-threats/2025/Exploits/CVE-2025-32463/file_event_lnx_exploit_cve_2025_32463.yml

@@ -0,0 +1,29 @@
+title: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
+id: 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
+status: experimental
+description: |
+    Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
+    This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
+    When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
+    potentially leading to arbitrary code execution and privilege escalation.
+references:
+    - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
+author: Swachchhanda Shrawn Poudel (Nextron Systems)
+date: 2025-10-02
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - cve.2025-32463
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: linux
+detection:
+    selection:
+        TargetFilename|endswith: '/etc/nsswitch.conf'
+    filter:
+        TargetFilename: '/etc/nsswitch.conf'
+    condition: selection and not filter
+falsepositives:
+    - Backup locations
+level: high

rules-emerging-threats/2025/Exploits/CVE-2025-32463/proc_creation_lnx_exploit_cve_2025_32463.yml

@@ -0,0 +1,28 @@
+title: Potential Sudo Chroot CVE-2025-32463 Vulnerability Exploitation
+id: f2bed782-994e-4f40-9cd5-518198cb3fba
+status: experimental
+description: |
+    Detects the use of sudo with the '--chroot' or '-R' options which could indicate a potential attempt to exploit CVE-2025-32463.
+    This is a local privilege escalation vulnerability in sudo 1.9.14 to 1.9.17 that allows loading arbitrary shared libraries from a user-controlled directory.
+references:
+    - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
+author: Swachchhanda Shrawn Poudel (Nextron Systems)
+date: 2025-10-02
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - cve.2025-32463
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: linux
+detection:
+    selection:
+        Image|endswith: '/sudo'
+        CommandLine|contains:
+            - ' --chroot '
+            - 'sudo -R '
+    condition: selection
+falsepositives:
+    - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.
+level: medium