Linux auditd: getcap scanning for setuid/setgid-capable files under root

Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Pawel Mazur (SigmaHQ), DRL 1.1
Published: 2021-11-28
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of the getcap command that query with the options `-r /`, indicating a recursive scan of the root filesystem for capability-bearing files. Such discovery can help an attacker identify privilege-escalation opportunities from binaries that have elevated capabilities. It relies on Linux auditd telemetry capturing process execution events with the specific command-line arguments `getcap -r /`.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

Suspicious Credential String Enumeration via findstr to Temp Directory

Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)

Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)

Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)

Suspicious Sang Loader Execution with Install or PassUAC Arguments

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

Possible GTFOBins Shell Breakout via Unix Utilities

Linux auditd: getcap scanning for setuid/setgid-capable files under root

Pivot detection · T1548 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-getcap-scans-for-capability-files-on-the-root-path-fe10751f

title: "Linux auditd: getcap scanning for setuid/setgid-capable files under root"
id: 01c8431c-1d10-449f-97c1-722daec0476a
status: test
description: This rule flags executions of the getcap command that query with the options `-r /`, indicating a recursive scan of the root filesystem for capability-bearing files. Such discovery can help an attacker identify privilege-escalation opportunities from binaries that have elevated capabilities. It relies on Linux auditd telemetry capturing process execution events with the specific command-line arguments `getcap -r /`.
references:
  - https://man7.org/linux/man-pages/man8/getcap.8.html
  - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
  - https://mn3m.info/posts/suid-vs-capabilities/
  - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-28
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.privilege-escalation
  - attack.t1083
  - attack.t1548
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: getcap
    a1: -r
    a2: /
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: fe10751f-1995-40a5-aaa2-c97ccb4123fe
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL