Detect Setuid and Setgid in Google Chronicle
Adversaries abuse the setuid (SUID) and setgid (SGID) permission bits on Linux and macOS to execute code in another user's context, typically root. When a file with SUID is executed, it runs as the file owner rather than the executing user. Adversaries can set SUID on their malware to enable future privilege escalation, or exploit existing SUID binaries listed on GTFOBins. Keydnap malware added setuid to binaries; Exaramel for Linux used a setuid binary for privilege escalation. The find command is commonly used by attackers to discover exploitable SUID/SGID binaries.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.001 Setuid and Setgid
- Canonical reference
- https://attack.mitre.org/techniques/T1548/001/
YARA-L Detection Query
rule t1548_001_setuid_setgid_abuse {
meta:
author = "Detection Engineering"
description = "Detects SUID/SGID bit manipulation via chmod, SUID discovery via find, and suspicious root execution from writable paths on Linux/macOS endpoints. Maps to MITRE ATT&CK T1548.001."
mitre_attack_tactic = "Privilege Escalation"
mitre_attack_technique = "T1548.001"
severity = "HIGH"
confidence = "HIGH"
events:
(
// Part 1: chmod setting SUID or SGID bits
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and $e.target.process.file.full_path = /\/chmod$/
and (
$e.target.process.command_line = /4[0-7]{3}/ nocase or
$e.target.process.command_line = /u\+s/ nocase or
$e.target.process.command_line = /\+s/ nocase or
$e.target.process.command_line = /2[0-7]{3}/ nocase or
$e.target.process.command_line = /g\+s/ nocase or
$e.target.process.command_line = /6[0-7]{3}/ nocase
)
)
or
// Part 2: find discovering SUID/SGID binaries (attacker recon)
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and $e.target.process.file.full_path = /\/find$/
and $e.target.process.command_line = /-perm/ nocase
and (
$e.target.process.command_line = /\+4000/ nocase or
$e.target.process.command_line = /-4000/ nocase or
$e.target.process.command_line = /\/4000/ nocase or
$e.target.process.command_line = /\+2000/ nocase or
$e.target.process.command_line = /-2000/ nocase or
$e.target.process.command_line = /setuid/ nocase or
$e.target.process.command_line = /setgid/ nocase
)
)
or
// Part 3: root execution from writable non-standard paths
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and $e.principal.user.userid = "root"
and (
$e.target.process.file.full_path = /^\/tmp\// or
$e.target.process.file.full_path = /^\/var\/tmp\// or
$e.target.process.file.full_path = /^\/dev\/shm\// or
$e.target.process.file.full_path = /^\/home\//
)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting SUID/SGID abuse across three behavioral patterns: chmod bit manipulation to grant SUID/SGID, find-based enumeration of SUID binaries as attacker reconnaissance, and suspicious execution of root-owned processes from world-writable directories. Covers T1548.001 privilege escalation setup and abuse phases.
Data Sources
Required Tables
False Positives & Tuning
- DevOps automation pipelines (CI/CD) that set SUID bits on utility binaries during build artifact preparation or container image construction
- Authorized red team engagements running find-based SUID enumeration as part of privilege escalation testing on agreed scope
- Root-privileged monitoring or backup agents legitimately executing from /home directories where their configuration files reside
Other platforms for T1548.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set SUID Bit on a Test Binary
Expected signal: Syslog/auditd: chmod syscall on /tmp/df00tech-suid-test with mode 04xxx. Process creation event for chmod with u+s argument. Sysmon for Linux (if deployed): FileModify event for /tmp/df00tech-suid-test.
- Test 2Discover SUID Binaries on the System
Expected signal: Process creation event for find with -perm /4000 argument. Syslog entry for find execution.
- Test 3Set SGID Bit on Test File
Expected signal: Auditd: chmod syscall with mode=02755 for /tmp/df00tech-sgid-test. Process creation for chmod command.
References (5)
- https://attack.mitre.org/techniques/T1548/001/
- https://gtfobins.github.io/#+suid
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- http://man7.org/linux/man-pages/man2/setuid.2.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md
Unlock Pro Content
Get the full detection package for T1548.001 including response playbook, investigation guide, and atomic red team tests.