attack.t1548.001

PwnKit Local Privilege Escalation

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.001 detection.emerging-threats cve.2021-4034 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Setuid and Setgid

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects suspicious change of file privileges with chown and chmod commands

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.