Who Became Root? Detect the Rogue Escalation, Not the Admin

Policy on host web01: only the sysadmin luke should ever use sudo to become root. But /var/log/auth.log shows a different account escalated to root — the classic sign of a compromised service pivoting to privilege escalation. The catch: luke sudo's to root many times a day, all legitimate. Build a detection that catches the rogue escalation without flagging the admin.

1. Identify the account that escalated to root but shouldn't have, and record it in /root/case/rogue_user.txt.

2. Write a detector at /root/detect.sh that reads auth.log on stdin and prints the offending username(s). Grading runs bash /root/detect.sh < /var/log/auth.log. Grading also feeds it a second, unseen log the same way, so it must work from what it reads on stdin, not from a hardcoded file path or answer.

3. The signal is IDENTITY, not volume: flag sudo-to-root by anyone who isn't luke. A rule that flags 'any sudo to root' flags the admin too — a false positive. MITRE ATT&CK: T1548 (Abuse Elevation Control Mechanism).