Linux Process Discovery via find Command Searching Setuid/SGID and Writable/Executable Files

Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.

FreeUnreviewedSigmamediumv1

linux-process-discovery-via-find-command-searching-setuid-sgid-and-writable-exec-8344c0e5

title: Linux Process Discovery via find Command Searching Setuid/SGID and Writable/Executable Files
id: e07f2949-0818-45b1-a1ab-28685fe32c35
related:
  - id: 85de3a19-b675-4a51-bfc6-b11a5186c971
    type: similar
  - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
    type: derived
status: test
description: This rule flags process creation where the executed binary ends with /find and the command line includes permissions-based checks indicating discovery of potentially sensitive files. Attackers commonly use find to locate setuid (−u=s) and setgid (−g=s) binaries or files with special and permissive permission modes to guide subsequent privilege escalation or persistence. Telemetry required is process creation data including the executable path and full command line arguments.
references:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /find
    CommandLine|contains:
      - -perm -4000
      - -perm -2000
      - -perm 0777
      - -perm -222
      - -perm -o w
      - -perm -o x
      - -perm -u=s
      - -perm -g=s
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where the executed binary ends with /find and the command line includes permissions-based checks indicating discovery of potentially sensitive files. Attackers commonly use find to locate setuid (−u=s) and setgid (−g=s) binaries or files with special and permissive permission modes to guide subsequent privilege escalation or persistence. Telemetry required is process creation data including the executable path and full command line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.