Sudoers File Modified for Privilege Escalation

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.