LiteLLM Proxy Spawns Shell/id as Root via Guardrail RCE
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
Microsoft Sentinel (KQL)
