Capsh Shell Invocation - Linux — Detection Rule

Detects the use of the "capsh" utility to invoke a shell.

Read the full analysis on IntelFusions