Shell Invocation via Apt - Linux

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•2•0•21

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.