Symlink to /etc/passwd Detection
This rule detects suspicious command-line executions that attempt to create symbolic links to the `/etc/passwd` file. Attackers might do this to gain unauthorized access to user account information, potentially leading to credential dumping or privilege escalation. The rule specifically looks for `ln -s /etc/passwd` and `ln -s -f /etc/passwd` patterns in command lines.
Sigma
