Script Execution with su - Copy Fail

Danny Y@zendannyy

•updated May 1, 2026•8•0•944

This rule detects the execution of the 'su' command on Linux systems. The 'su' command is used to run commands with a substitute user and group ID, most commonly to switch to the root user. Related to Copy Fail