Elastic low stable eql
Unusual Sudo Activity
Looks for sudo activity from an unusual user context. An unusual sudo user could be due to troubleshooting activity or it could be a sign of credentialed access via compromised accounts.
Detection Logic
False Positives
- ⚠ Uncommon sudo activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
Field Validations
Loading…
Comments (0)
Loading comments...