`cmdline=sudo amp amp path = usr bin sudo` or whatever osquery #general

`cmdline=sudo* && path!=/usr/bin/sudo` or...

c

clong

03/03/2018, 1:26 AM

cmdline=sudo* && path!=/usr/bin/sudo

or whatever