Shell Execution via Flock - Linux
This rule detects the use of the 'flock' command in conjunction with common shell binaries to execute a shell. This behavior can be indicative of privilege escalation attempts, unauthorized command execution, or efforts to break out of restricted environments. The rule specifically looks for the 'flock' command being executed with the '-u' option and a command line containing paths to common shells like bash, dash, fish, sh, or zsh.
Sigma
