Detecting and responding to Dirty Pipe with Elastic

This report details Dirty Pipe (CVE-2022-0847), a Linux local privilege escalation vulnerability that leverages a pipe page splicing flaw to overwrite read-only files (e.g., /etc/passwd) or inject SUID backdoors; it explains the root cause, outlines common proof-of-concept exploitation steps, and provides Elastic-specific detection rules, collection guidance (Auditd/Auditbeat/Filebeat/Elastic Agent/Osquery), and mitigation recommendations.