Skip to content
Threat Feed
Subscribe

Tag

Unshare

1 brief RSS
high advisory

Potential Privilege Escalation via unshare and UID Change

This rule detects potential privilege escalation attempts on Linux systems by identifying suspicious use of the `unshare` command to create user namespaces followed by a UID change to root, indicative of local privilege escalation.

Elastic Defend +1 privilege-escalation linux unshare namespace
2r 2t