Check for issues using Exploit Suggester
The pfexec program is used to execute commands with the attributes specified by the user’s profiles in the exec_attr(4) database. It is invoked by the profile shells, pfsh, pfcsh, and pfksh which are linked to the Bourne shell, C shell, and Korn shell, respectively.
If we find SUID binary
Find / -perm -u=s -type f 2>/dev/null
pfexec bash