Linux setcap sets cap_setuid on a binary via setcap utility

Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.

FreeReviewedSigma · Low · v3

Product: linux
Category: process_creation
Author: Luc Génaux (SigmaHQ), DRL 1.1
Published: 2026-01-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1554Compromise Host Software Binary
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process activity where the setcap utility is used to set the cap_setuid capability on a binary (via CommandLine containing cap_setuid and the executable path ending with /setcap). Granting cap_setuid allows a process to manipulate user IDs, potentially enabling execution paths that would otherwise be restricted. Telemetry required includes Linux process creation fields: the process image path and the command-line arguments.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Malicious Backdoored liblzma XZ Utils Library File via file_event

Suspicious User Home Directory Modification via dscl Process Creation

Possible GTFOBins Shell Breakout via apt Command

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Malicious macOS Credential Verification via dscl authonly

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Linux setcap sets cap_setuid on a binary via setcap utility

Pivot detection · T1548 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-setcap-sets-cap-setuid-on-a-binary-via-process-execution-ed447910

title: Linux setcap sets cap_setuid on a binary via setcap utility
id: d6870da4-cc20-4ece-9c1d-b39ebe87fe06
status: experimental
description: "This rule identifies process activity where the setcap utility is used to set the cap_setuid capability on a binary (via CommandLine containing cap_setuid and the executable path ending with /setcap). Granting cap_setuid allows a process to manipulate user IDs, potentially enabling execution paths that would otherwise be restricted. Telemetry required includes Linux process creation fields: the process image path and the command-line arguments."
references:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setuid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml
author: Luc Génaux, Huntrule Team
date: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548
  - attack.t1554
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /setcap
    CommandLine|contains: cap_setuid
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: ed447910-bc30-4575-a598-3a2e49516a7a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL