kqlElastic-2.0from elastic/detection-rules
Potential Privilege Escalation via Sudoers File Modification
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml
event.category:process and event.type:start and process.args:(echo and *NOPASSWD*ALL*)