Capsh Shell Invocation - Linux
This rule detects the execution of the 'capsh' utility followed by a double dash ('--'), which is a common pattern used to invoke a shell through 'capsh'. This technique can be used by adversaries to bypass restricted shell environments or escalate privileges by leveraging 'capsh' capabilities.
Sigma
