Linux setcap sets cap_setuid on a binary via setcap utility
Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.
- Product
- linux
- Category
- process_creation
- Author
- Luc Génaux (SigmaHQ), DRL 1.1
- Published
- 2026-01-24
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process activity where the setcap utility is used to set the cap_setuid capability on a binary (via CommandLine containing cap_setuid and the executable path ending with /setcap). Granting cap_setuid allows a process to manipulate user IDs, potentially enabling execution paths that would otherwise be restricted. Telemetry required includes Linux process creation fields: the process image path and the command-line arguments.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux setcap sets cap_setuid on a binary via setcap utility
id: d6870da4-cc20-4ece-9c1d-b39ebe87fe06
status: experimental
description: "This rule identifies process activity where the setcap utility is used to set the cap_setuid capability on a binary (via CommandLine containing cap_setuid and the executable path ending with /setcap). Granting cap_setuid allows a process to manipulate user IDs, potentially enabling execution paths that would otherwise be restricted. Telemetry required includes Linux process creation fields: the process image path and the command-line arguments."
references:
- https://man7.org/linux/man-pages/man8/setcap.8.html
- https://dfir.ch/posts/linux_capabilities/
- https://juggernaut-sec.com/capabilities/#cap_setuid
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml
author: Luc Génaux, Huntrule Team
date: 2026-01-24
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1548
- attack.t1554
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /setcap
CommandLine|contains: cap_setuid
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: ed447910-bc30-4575-a598-3a2e49516a7a
type: derived