BIOC
Informational
✕
Discovery of files with setgid or setuid bits
Attackers may try to locate files with setgid or setuid bits set to escalate privileges.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Privilege Escalation
- Status:
- Enabled
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
Indicator:
Process action type = execution AND target process cmd = * -perm *-4000* , * -perm *-2000* , * -perm *g+s* , * -perm *u+s* , * -perm *g=s* , * -perm *u=s* AND target process name = find Process initiated by != ir_agent AND cgo name != ir_agent
Preventable: yes