Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Linux Auditd Setuid Using Chmod Utility

The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Linux…

Description

The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Linux Auditd, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.

Detection logic

Detection requirements

Platform
LinuxmacOS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_proctitle

Known benign triggers

  • Administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice