attack.t1548.001

PwnKit Local Privilege Escalation

Aug 12, 2024 · attack.privilege-escalation attack.t1548.001 ·

Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Setuid and Setgid

Aug 12, 2024 · attack.persistence attack.t1548.001 ·

Share on:

Detects suspicious change of file privileges with chown and chmod commands

Find Binary Searching for Executables with Setuid or Setguid Bit (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1548.001 ·

Share on:

Detects search for setuid or setgid binaries. This rule looks specifically for execution of the find binary searching for executables with the setuid or setgid bit set. Part of the RedCanary 2023 Threat Detection Report.