Sudo Chroot Option Usage

kevin rutherford@necsorte

•updated Jul 4, 2025•2•3•134

Detects the execution of the `sudo` command with the `chroot` option (`-C` or `--chroot`). This could be an indicator of an attempt to exploit privilege escalation vulnerabilities like CVE-2025-32463.