Rule Info
Description
Detects a Linux shell script that explores privilege escalation vectors
Reference
Internal Research
Tags
['HKTL', 'LINUX', 'T1068', 'SCRIPT']
Date
2022-01-26
Required Modules
[]
Rule Hash
2629d62367badc79d9f9824fb28e28b5
Score
90
Av Ratio
12.63
Name
HKTL_LNX_SH_PrivEsc_Jan22_1
Author
Florian Roth
Minimum Yara
1.7
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
10
Suspicious (< 10 engines)
31
Clean (0 engines)
0
Rule Matches
Total
Timestamp
Hash
Positives
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR