SSH Sudo Privilege Escalation Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.