Linux setcap sets cap_setuid on a binary via process execution

title: Linux setcap sets cap_setuid on a binary via process execution
id: d6870da4-cc20-4ece-9c1d-b39ebe87fe06
status: experimental
description: This rule flags process executions of the setcap utility where the command line includes the cap_setuid capability. Setting cap_setuid on a binary can allow non-privileged execution to manipulate user identity and potentially obtain restricted UID values. The detection relies on Linux process creation telemetry, matching the setcap binary path and the presence of cap_setuid in the command line.
references:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setuid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml
author: Luc Génaux, Huntrule Team
date: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548
  - attack.t1554
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /setcap
    CommandLine|contains: cap_setuid
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: ed447910-bc30-4575-a598-3a2e49516a7a
    type: derived