NSudo Execution for Privilege Elevation
Detects the execution of the NSudo utility, a tool that allows users to run programs with elevated privileges such as System, Trusted Installer, or with all privileges enabled. The rule specifically looks for NSudo executable names and common command-line arguments used to request these elevated privileges.
Sigma
