Suspiciou Use of 'splice' with Privilege Escalation - Copy Fail

Danny Y@zendannyy

•updated May 1, 2026•14•0•1,187

This rule detects the execution of commands that include 'splice' in conjunction with common privilege escalation utilities such as 'su', 'sudo', or 'passwd', or attempts to access '/etc/passwd'. This privilege escalation resembles Copy Fail.