PUA - Wsudo Suspicious Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.