Linux Capabilities Discovery

calendar Oct 23, 2025 · attack.defense-evasion attack.collection attack.privilege-escalation attack.t1123 attack.t1548  ·
Share on: linkedin copy

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Sigma rule (View on GitHub)

 1title: Linux Capabilities Discovery
 2id: fe10751f-1995-40a5-aaa2-c97ccb4123fe
 3status: test
 4description: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.
 5references:
 6    - https://man7.org/linux/man-pages/man8/getcap.8.html
 7    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
 8    - https://mn3m.info/posts/suid-vs-capabilities/
 9    - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
10author: 'Pawel Mazur'
11date: 2021-11-28
12modified: 2022-12-25
13tags:
14    - attack.defense-evasion
15    - attack.collection
16    - attack.privilege-escalation
17    - attack.t1123
18    - attack.t1548
19logsource:
20    product: linux
21    service: auditd
22detection:
23    selection:
24        type: EXECVE
25        a0: getcap
26        a1: '-r'
27        a2: '/'
28    condition: selection
29falsepositives:
30    - Unknown
31level: low

References

Related rules

to-top