cscli collections install crowdsecurity/linux-lpeThis collection aims at detecting (when possible) local privilege escalation attacks.
⚠️ Please note those scenarios are detection only, and are very likely to be bypassed by smart attackers, do not rely solely on them ⚠️
Example acquisition for this collection :
1filenames:2 - /var/log/auth.log3 - /var/log/kern.log4labels:5 type: syslog
If you want to get kernel log through journalctl
1source: journalctl2journalctl_filter:3 - "-k"4labels:5 type: syslog
notes :