Shell Execution via Rsync - Linux

SigmaHQ Detections@sigmaHQ

•updated Jan 19, 2025•2•0•21

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.