Linux auditd: getcap scanning for setuid/setgid-capable files under root

Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: Pawel Mazur (SigmaHQ), DRL 1.1
Published: 2021-11-28
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of the getcap command that query with the options `-r /`, indicating a recursive scan of the root filesystem for capability-bearing files. Such discovery can help an attacker identify privilege-escalation opportunities from binaries that have elevated capabilities. It relies on Linux auditd telemetry capturing process execution events with the specific command-line arguments `getcap -r /`.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Suspicious User Home Directory Modification via dscl Process Creation

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

Possible GTFOBins Shell Breakout via apt Command

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Malicious macOS Credential Verification via dscl authonly

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Linux auditd: getcap scanning for setuid/setgid-capable files under root

Pivot detection · T1548 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-getcap-scans-for-capability-files-on-the-root-path-fe10751f

title: "Linux auditd: getcap scanning for setuid/setgid-capable files under root"
id: 01c8431c-1d10-449f-97c1-722daec0476a
status: test
description: This rule flags executions of the getcap command that query with the options `-r /`, indicating a recursive scan of the root filesystem for capability-bearing files. Such discovery can help an attacker identify privilege-escalation opportunities from binaries that have elevated capabilities. It relies on Linux auditd telemetry capturing process execution events with the specific command-line arguments `getcap -r /`.
references:
  - https://man7.org/linux/man-pages/man8/getcap.8.html
  - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
  - https://mn3m.info/posts/suid-vs-capabilities/
  - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-28
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.privilege-escalation
  - attack.t1083
  - attack.t1548
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: getcap
    a1: -r
    a2: /
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: fe10751f-1995-40a5-aaa2-c97ccb4123fe
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL