VerdantBamboo egnyteservice sudo tee Privilege Escalation on Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

Detects potential privilege escalation and unauthorized file modification by the 'egnyteservice' account. The rule monitors Syslog for sudo usage involving the 'tee' utility with 'NOPASSWD' configuration, or suspicious writes to critical system directories such as /usr/sbin/ and /etc/cron.d/, which are indicative of VerdantBamboo threat actor activity on edge appliances.