VerdantBamboo Sudo Privilege Escalation via Tee

Ethan Andrews@eandrews

•updated Jun 5, 2026•1•0•6

Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.