Sunturai
Back to results
LowSigmaHQLuc Génaux

Linux Setgid Capability Set on a Binary via Setcap Utility

Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including…

Description

Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

Detection logic

Detection requirements

Platform
ESXiIaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
linux
Log source category
process_creation

Known benign triggers

  • Unknown

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice