Skip to content
Last update: 2022-05-10

T1548.003 Sudo

T1548.003

Required Tables

  • shell_commands

Returned Fields

Field Description
shell_commands.* all fields for shell commands where privilege escalation used sudo

Query

SELECT *
FROM shell_commands 
WHERE program_filename IN ('/usr/bin/sudo', '/bin/su')
Back to top