Linux GNU Awk Sudo Escalation
The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages EDR telemetry to identify command-line execution data. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root.
Sigma
