attack.t1548.001

Setuid and Setgid

Jun 4, 2025 · attack.persistence attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects suspicious change of file privileges with chown and chmod commands

PwnKit Local Privilege Escalation

Sep 13, 2024 · attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.