Linux auditd: getcap scans for capability files on the root path

title: "Linux auditd: getcap scans for capability files on the root path"
id: 01c8431c-1d10-449f-97c1-722daec0476a
status: test
description: This rule matches execve events where the getcap utility is executed with arguments indicating a recursive scan under the root directory for files with capability attributes. Attackers use capability discovery to identify misconfigured binaries that may enable privilege escalation. The detection relies on Linux auditd process execution telemetry capturing the executable name and its command-line arguments.
references:
  - https://man7.org/linux/man-pages/man8/getcap.8.html
  - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
  - https://mn3m.info/posts/suid-vs-capabilities/
  - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-28
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.privilege-escalation
  - attack.t1083
  - attack.t1548
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: getcap
    a1: -r
    a2: /
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: fe10751f-1995-40a5-aaa2-c97ccb4123fe
    type: derived