Linux Capabilities Discovery via getcap -r

title: Linux Capabilities Discovery via getcap -r
id: a5f6ab06-0994-4603-b85f-331d286a62f0
status: test
description: Identifies process execution of the getcap utility with recursive listing enabled (CommandLine contains ' -r ') by matching the executable path ending in '/getcap'. Attackers commonly use this to enumerate file capabilities that may be misused for privilege escalation or other post-compromise discovery. Telemetry relies on Linux process creation events including the process image path and full command line.
references:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/carlospolop/PEASS-ng
  - https://github.com/diego-treitos/linux-smart-enumeration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
modified: 2026-01-24
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /getcap
    CommandLine|contains: " -r "
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d8d97d51-122d-4cdd-9e2f-01b4b4933530
    type: derived