Linux process activity: chown root and setuid/setgid chmod flags
Alerts on Linux command lines that set root ownership and enable setuid/setgid via chmod u+s or g+s.
- Product
- linux
- Category
- process_creation
- Author
- Ömer Günal (SigmaHQ), DRL 1.1
- Published
- 2020-06-16
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions where command lines include changing ownership to root via chown root and enabling setuid or setgid via chmod u+s or chmod g+s. Attackers may use these file permission changes to persist or escalate privileges by allowing programs to run with elevated rights. Detection relies on process creation telemetry with the full command line captured for chown and chmod invocations.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux process activity: chown root and setuid/setgid chmod flags"
id: 55b7c676-a98b-4eed-8df3-1ae2f079f23b
status: test
description: This rule flags Linux process executions where command lines include changing ownership to root via chown root and enabling setuid or setgid via chmod u+s or chmod g+s. Attackers may use these file permission changes to persist or escalate privileges by allowing programs to run with elevated rights. Detection relies on process creation telemetry with the full command line captured for chown and chmod invocations.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml
author: Ömer Günal, Huntrule Team
date: 2020-06-16
modified: 2022-10-05
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1548.001
logsource:
product: linux
category: process_creation
detection:
selection_root:
CommandLine|contains: chown root
selection_perm:
CommandLine|contains:
- " chmod u+s"
- " chmod g+s"
condition: all of selection_*
falsepositives:
- Legitimate administration activities
level: low
license: DRL-1.1
related:
- id: c21c4eaa-ba2e-419a-92b2-8371703cbe21
type: derived