Linux: Suspicious chown root and chmod u+s/g+s indicating setuid/setgid changes

Alerts on Linux command lines that set root ownership and enable setuid/setgid via chmod u+s or g+s.

FreeUnreviewedSigmalowv1

linux-suspicious-chown-root-and-chmod-u-s-g-s-indicating-setuid-setgid-changes-c21c4eaa

title: "Linux: Suspicious chown root and chmod u+s/g+s indicating setuid/setgid changes"
id: 55b7c676-a98b-4eed-8df3-1ae2f079f23b
status: test
description: This rule flags process executions whose command lines contain 'chown root' along with chmod modifications that enable setuid (u+s) or setgid (g+s). Such changes can allow an attacker-controlled binary or file to run with elevated privileges, which is commonly abused for persistence or privilege escalation. Detection relies on Linux process creation telemetry and matching specific substrings in the executed command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml
author: Ömer Günal, Huntrule Team
date: 2020-06-16
modified: 2022-10-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1548.001
logsource:
  product: linux
  category: process_creation
detection:
  selection_root:
    CommandLine|contains: chown root
  selection_perm:
    CommandLine|contains:
      - " chmod u+s"
      - " chmod g+s"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: c21c4eaa-ba2e-419a-92b2-8371703cbe21
    type: derived

What it detects

This rule flags process executions whose command lines contain 'chown root' along with chmod modifications that enable setuid (u+s) or setgid (g+s). Such changes can allow an attacker-controlled binary or file to run with elevated privileges, which is commonly abused for persistence or privilege escalation. Detection relies on Linux process creation telemetry and matching specific substrings in the executed command line.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.