VerdantBamboo LPE: sudo Abuse and Root Shell on Linux/BSD Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous process execution patterns indicative of privilege escalation or persistence on Linux systems. Specifically monitors for unexpected root shell access from non-privileged service accounts (e.g., www-data, apache), abuse of sudo for modifying privileged system files via tee, and execution of binaries from world-writable directories such as /tmp or /dev/shm, which is a common behavior during exploit staging.