Why root access is no longer the end of an attack
A Linux system is running normally, with no alerts, no suspicious activity, and nothing out of place. Somewhere in the background, however, a low-privileged account exists on that machine, this could be a compromised user, a container escape, or simply reused credentials that were never rotated. At some point, that access is used, not to deploy malware or trigger alarms, but simply to execute a small piece of code that blends into normal activity. Moments later, the attacker has elevated...
