3BB: Root Access Anomalous by Source, Timing, or Account Approval

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.