Sudo privilege escalation to root via python3.12 (NOPASSWD)

Ibrahim Saud@tektrix

•updated Sep 24, 2026•3•0•5

Detects the execution of Python 3.12 commands via 'sudo' to elevate privileges to 'root'. The rule monitors for instances where a non-root account invokes 'sudo python3.12' and subsequently spawns a process or logs activity confirming a root-level execution session within a short time window.