Randall's questions

In SCOM notifications, the last line reads

Notification subscription ID generating this message: {DFF2B469-4D4D-3F82-C51B-FCAC7A863DE6}

I want to convert the GUID to the Subscription Name. I've searched and found references to using

Get-NotificationSubscription -id DFF2B469-4D4D-3F82-C51B-FCAC7A863DE6 | ft Display

But I'm just getting either the error

'Get-NotificationSubscription' is not recognized as an internal or external command, operable program or batch file.

from the command prompt, or

Get-NotificationSubscription : The term 'Get-NotificationSubscription' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

from PowerShell.

Haven't figured out what I might be doing wrong yet.

A user on our (openSuSE) linux systems attempted to run sudo, and triggered an alert. He has the environment variable EGG set -

EGG=UH211åH1ÒH»ÿ/bin/shHÁSH211çH1ÀPWH211æ°;^O^Ej^A_j<X^O^EÉÃÿ

This looks unusual to say the least.

Is EGG a legitimate environment variable? (I've found some references to PYTHON_EGG_CACHE - could be related? But that environment variable isn't set for this user). If it's legit, then I imagine this group has the best chance of recognizing it.

Or, given the embedded /bin/sh in the string above, does anyone recognize this as an exploit fingerprint? It wouldn't be the first time we had a cracked account (sigh).