{"id":"fe10751f-1995-40a5-aaa2-c97ccb4123fe","title":"Linux Capabilities Discovery","description":"Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.","author":"Pawel Mazur","status":"test","level":"low","date":"2021-11-28","modified":"2022-12-25","tags":["attack.discovery","attack.privilege-escalation","attack.t1083","attack.t1548"],"technique_ids":["T1083","T1548"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Unknown"],"references":["https://man7.org/linux/man-pages/man8/getcap.8.html","https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/","https://mn3m.info/posts/suid-vs-capabilities/","https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099"],"source_path":"rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml","source_sha256":"3da7104c23a1f936c80cc1c9786a549ae4982f3fd02bcdd8e8de0f96575239d7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Capabilities Discovery\nid: fe10751f-1995-40a5-aaa2-c97ccb4123fe\nstatus: test\ndescription: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.\nreferences:\n    - https://man7.org/linux/man-pages/man8/getcap.8.html\n    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/\n    - https://mn3m.info/posts/suid-vs-capabilities/\n    - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099\nauthor: 'Pawel Mazur'\ndate: 2021-11-28\nmodified: 2022-12-25\ntags:\n    - attack.discovery\n    - attack.privilege-escalation\n    - attack.t1083\n    - attack.t1548\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection:\n        type: EXECVE\n        a0: getcap\n        a1: '-r'\n        a2: '/'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","page":"techniques/enterprise/T1083/"},{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","page":"techniques/enterprise/T1548/"}],"data_path":"data/detection-rules/fe10751f-1995-40a5-aaa2-c97ccb4123fe.json","kind":"sigma"}