VerdantBamboo: Sudo Abuse for LPE on Edge Appliances (BRICKSTORM)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.