T1548.001 — Setuid and Setgid

Tactic: Privilege Escalation · Platforms: Linux, macOS

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (2)

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

title: "T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid"
id: 5ba83cb4-1c99-45e5-a97f-8c3e42140a6d
description: 'Setuid/Setgid privilege abuse detection. The original selection detected "setcap ... cap_setuid", which assigns Linux capabilities -- a related but distinct privilege-escalation primitive, not the setuid/setgid file-permission bits this technique describes. Retargeted to chmod invocations that set the setuid or setgid bit, matching both symbolic (u+s, g+s) and numeric (leading digit 4/2/6/7) mode syntax, plus find invocations used for setuid/setgid binary discovery as described by the technique. Tune using: UserContext, FilePathScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1548/001
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_chmod_symbolic:
    type: EXECVE
    a0|endswith: '/chmod'
    a1|contains:
      - 'u+s'
      - 'g+s'
      - 'ug+s'
      - '+s'
  selection_chmod_numeric:
    type: EXECVE
    a0|endswith: '/chmod'
    a1|re: '^[4267][0-7]{3}
    
  


  selection_find_setuid_discovery:
    type: EXECVE
    a0|endswith: '/find'
    a1|contains: '-perm'

  condition: selection_chmod_symbolic or selection_chmod_numeric or selection_find_setuid_discovery

falsepositives:
  - Legitimate package installation/build scripts (e.g. postinst scripts for ping, sudo, mount) setting setuid bits during system setup; container image builds; system administrators auditing binaries with find -perm as part of routine hardening reviews. Scope FilePathScope to paths outside the expected build/package-manager pipeline.

level: high

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

title: "T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid"
id: 59d0cc6d-ce58-4962-9720-8ee85810f3f6
description: 'Setuid/Setgid Privilege Abuse Detection (Linux/macOS). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, ExecutionPath, ChmodPattern.'
references:
  - https://attack.mitre.org/techniques/T1548/001
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.001

logsource:
  product: macos

detection:
  selection:
    Image|endswith: '/chmod'
  selection_args:
    CommandLine|contains:
      - '+s'
      - '4755'
      - '2755'
  condition: selection and selection_args

falsepositives:
  - Package installers occasionally set the setuid bit on privileged helper binaries during legitimate installation, so this should be reviewed for whether the target binary is a known signed helper tool rather than a user-writable script.

level: high

Related sub-techniques

Explore