CopyFail Detection via Non-root Launching su via Uncommon Parent Process

Tun Tun Naing@tuntun

•updated May 9, 2026•22•0•1,058

Query looks for non-root users launching the switch user (su) process via a parent process other than the normally expected processes such as shells, sudo, or su itself.