Local privilege escalation via sudo -S -p and systemd-run --system --no-ask-password
Detects the execution of 'sudo' or 'systemd-run' with specific flags often associated with automated credential processing or service creation for privilege escalation. The rule monitors for sudo commands using '-S' (read from stdin) and '-p' (custom prompt) flags, which are common in non-interactive scripts attempting to bypass or manipulate password prompts, and systemd-run commands using '--system' and '--no-ask-password', which can be used to run commands as root without interactive authentication.
Microsoft Sentinel (KQL)
