Privilege Escalation and Admin Function Access

Consolidated detection for privilege escalation attempts, covering both tool permission escalation and unauthorized admin function access. Detects when an agent requests or uses tools exceeding its permission scope, invokes administrative functions (user management, database admin, system config), attempts system-level operations (sudo, chmod, chown), container escape techniques (nsenter, chroot), or Kubernetes privilege escalation (kubectl exec). This rule enforces least-privilege boundaries across all agent tool interactions.

Response Actions

References