BeyondTrust appliance zz-root-persist post_boot.d NOPASSWD sudoers persistence
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Microsoft Sentinel (KQL)
