Linux Capabilities Discovery

Title: Linux Capabilities Discovery
Status: test
Description:Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.
References:
  -https://man7.org/linux/man-pages/man8/getcap.8.html
  -https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
  -https://mn3m.info/posts/suid-vs-capabilities/
  -https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
Author: Pawel Mazur
Date: 2021-11-28
modified:2022-12-25
Tags:

• -'attack.discovery'
• -'attack.privilege-escalation'
• -'attack.t1083'
• -'attack.t1548'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0: 'getcap'
    a1: '-r'
    a2: '/'
  condition:selection
Falsepositives:
  -Unknown
Level: low