Screen Sharing Sudoers.d Privesc to Root Shell + Callback (Correlated)

Duo Tech@duotech

•updated Aug 17, 2026•0•0•4

Detects the correlated sudoers-based privilege escalation chain: a non-root user writing a root-owned sudoers.d policy via the Screen Sharing file-copy channel, followed by passwordless sudo execution, followed by an outbound network connection as root within bounded time windows.