package_info.pl abuse to execute malicious license.tmp as root
Detects the execution of a Perl script named 'package_info.pl' with specific command-line arguments involving 'license.tmp' located in '/var/tmp/'. This pattern may indicate the execution of unauthorized tools, license bypass attempts, or potentially malicious scripts masquerading as legitimate license management utilities.
Microsoft Sentinel (KQL)
