dirty frag

Luís Marques@remotecodeexecution

•updated 5 days ago•0•0•2

This rule detects a multi-stage potential local privilege escalation attack sequence (often associated with Dirty Frag TTPs) where an ELF binary is created in a user-controlled or temporary directory, subsequently executed, and finally initiates a 'su' process.