Shai-Hulud Privilege Escalation Attempt

Tim Peck@timpeck

•updated Dec 9, 2025•10•1•242

Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.