Linux Unexpected Process Spawning su
Detects instances where a non-root user process launches 'su' or a shell command executing 'su' from an unusual parent process (excluding standard shells like bash/sh/zsh/ksh or elevation tools like sudo/su). This is used to identify suspicious attempts to switch user context or escalate privileges.
Cortex XDR
