Linux Make Arbitrary Makefile Execution
This rule detects the execution of the 'make' command with a '-f' flag pointing to a makefile located in common temporary or writable directories. This behavior can be indicative of an adversary attempting to execute arbitrary commands or escalate privileges by leveraging the 'make' utility to process a malicious makefile from a non-standard location.
CQL
