1200KM / sigma-rule
Capabilities Discovery - Linux — Sigma Rule
Sigma rule d8d97d51-122d-4cdd-9e2f-01b4b4933530. Capabilities Discovery - Linux — Sigma Rule. Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: low. Source dates: 2022-12-28 / 2026-01-24.
{
"category": "process_creation",
"product": "linux"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: cc46db8bc81860e2c0ecd59f4590d9cb2bbbfa48203ecaf6ebe83dea23238a8a
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Capabilities Discovery - Linux
id: d8d97d51-122d-4cdd-9e2f-01b4b4933530
status: test
description: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.
references:
- https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
- https://github.com/carlospolop/PEASS-ng
- https://github.com/diego-treitos/linux-smart-enumeration
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-28
modified: 2026-01-24
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: '/getcap'
CommandLine|contains: ' -r '
condition: selection
falsepositives:
- Unknown
level: low
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.