Linux Privilege Capability Discovery via getcap
Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-28
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of the getcap binary, specifically when the command line includes ' -r ' to enumerate file capabilities recursively. Attackers commonly use this to discover misconfigurations that may be leveraged for privilege escalation or further local discovery. Telemetry relies on Linux process creation events including the image path and command-line arguments.
Reporting behind it
- github.comhttps://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
- github.comhttps://github.com/carlospolop/PEASS-ng
- github.comhttps://github.com/diego-treitos/linux-smart-enumeration
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Privilege Capability Discovery via getcap
id: a5f6ab06-0994-4603-b85f-331d286a62f0
status: test
description: This rule identifies process executions of the getcap binary, specifically when the command line includes ' -r ' to enumerate file capabilities recursively. Attackers commonly use this to discover misconfigurations that may be leveraged for privilege escalation or further local discovery. Telemetry relies on Linux process creation events including the image path and command-line arguments.
references:
- https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
- https://github.com/carlospolop/PEASS-ng
- https://github.com/diego-treitos/linux-smart-enumeration
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
modified: 2026-01-24
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /getcap
CommandLine|contains: " -r "
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: d8d97d51-122d-4cdd-9e2f-01b4b4933530
type: derived