{"id":"ed447910-bc30-4575-a598-3a2e49516a7a","title":"Linux Setuid Capability Set on a Binary via Setcap Utility","description":"Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.\nThis capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).\nThis behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\n","author":"Luc Génaux","status":"experimental","level":"low","date":"2026-01-24","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.t1548","attack.t1554"],"technique_ids":["T1548","T1554"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://man7.org/linux/man-pages/man8/setcap.8.html","https://dfir.ch/posts/linux_capabilities/","https://juggernaut-sec.com/capabilities/#cap_setuid"],"source_path":"rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml","source_sha256":"b79a8ce2abdcc3acc053218ab0e83a3a226a90da599a33a143e8e5246a5747a0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Setuid Capability Set on a Binary via Setcap Utility\nid: ed447910-bc30-4575-a598-3a2e49516a7a\nstatus: experimental\ndescription: |\n    Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.\n    This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).\n    This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\nreferences:\n    - https://man7.org/linux/man-pages/man8/setcap.8.html\n    - https://dfir.ch/posts/linux_capabilities/\n    - https://juggernaut-sec.com/capabilities/#cap_setuid\nauthor: Luc Génaux\ndate: 2026-01-24\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1548\n    - attack.t1554\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/setcap'\n        CommandLine|contains: 'cap_setuid'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","page":"techniques/enterprise/T1548/"},{"key":"enterprise/T1554","id":"T1554","name":"Compromise Host Software Binary","page":"techniques/enterprise/T1554/"}],"data_path":"data/detection-rules/ed447910-bc30-4575-a598-3a2e49516a7a.json","kind":"sigma"}