Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.

FreeReviewedSigma · Low · v3

Product: linux
Category: process_creation
Author: Luc Génaux (SigmaHQ), DRL 1.1
Published: 2026-01-24
Updated: 2026-07-31

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1554Compromise Host Software Binary
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of the setcap utility where the command line includes cap_setgid, indicating a binary has its setgid-related capability assigned. Granting cap_setgid can enable a process without full privileges to perform group ID (GID) operations that may otherwise be restricted, which can support persistence or future privilege-related actions. The detection relies on Linux process creation telemetry, matching the setcap executable path and the presence of cap_setgid in the command line.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Linux setcap sets cap_setuid on a binary via setcap utility

Malicious Backdoored liblzma XZ Utils Library File via file_event

Suspicious User Home Directory Modification via dscl Process Creation

Possible GTFOBins Shell Breakout via apt Command

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Malicious macOS Credential Verification via dscl authonly

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Pivot detection · T1548 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-setcap-used-to-assign-cap-setgid-setgid-capability-to-a-binary-3a716279

title: Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
id: 3edc06ed-5c9b-4ccd-89ba-59fcc26e4d26
status: experimental
description: This rule identifies process executions of the setcap utility where the command line includes cap_setgid, indicating a binary has its setgid-related capability assigned. Granting cap_setgid can enable a process without full privileges to perform group ID (GID) operations that may otherwise be restricted, which can support persistence or future privilege-related actions. The detection relies on Linux process creation telemetry, matching the setcap executable path and the presence of cap_setgid in the command line.
references:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setgid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setgid.yml
author: Luc Génaux, Huntrule Team
date: 2026-01-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548
  - attack.t1554
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /setcap
    CommandLine|contains: cap_setgid
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 3a716279-c18c-4488-83be-f9ececbfb9fc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL