Shell Execution via Flock - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•0•0

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.