Linux sudo alias password interception via shell startup file (CL-UNK-1211)
Detects unexpected modifications or access to Linux startup files (.bashrc, .bash_profile, .profile) by suspicious utility or web server processes, addition of sudo alias commands in startup files, and activity associated with Solarwinds StatusLog files.
Microsoft Sentinel (KQL)
