Linux: setcap used to assign cap_setgid (setgid capability) to a binary

title: "Linux: setcap used to assign cap_setgid (setgid capability) to a binary"
id: 3edc06ed-5c9b-4ccd-89ba-59fcc26e4d26
status: experimental
description: This rule identifies execution of the Linux setcap utility where the command line includes cap_setgid, indicating an attacker is configuring a binary with the set-group-ID capability. Granting cap_setgid can enable operations involving group IDs that would typically be restricted, which may help with persistence or staged privilege impact. The detection relies on process creation telemetry, matching the setcap binary path and the presence of cap_setgid in the command line.
references:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setgid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setgid.yml
author: Luc Génaux, Huntrule Team
date: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548
  - attack.t1554
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /setcap
    CommandLine|contains: cap_setgid
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 3a716279-c18c-4488-83be-f9ececbfb9fc
    type: derived