The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt. This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise. If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.