← Library
kqlElastic-2.0from elastic/detection-rules

Deprecated - Sudo Heap-Based Buffer Overflow Attempt

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1068T1548T1548.003
Rule sourcerules/cross-platform/privilege_escalation_sudo_buffer_overflow.toml
event.category:process and event.type:start and
  process.name:(sudo or sudoedit) and
  process.args:(*\\ and ("-i" or "-s"))