Sudo Privilege Escalation Attempt via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.