macOS Process Execution of find with Setuid/Setgid or World-Writable Permission Discovery Flags

title: macOS Process Execution of find with Setuid/Setgid or World-Writable Permission Discovery Flags
id: 0ae22114-1f7c-42d5-9a62-3feb9803e0bd
related:
  - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
    type: similar
  - id: 85de3a19-b675-4a51-bfc6-b11a5186c971
    type: derived
status: test
description: This rule flags process creations where the executed binary path ends with /find and the command line includes permission-test options indicating setuid/setgid and writable/accessible modes (e.g., -perm -4000, -perm -2000, 0777, -o w, -o x, -u=s, -g=s). Such permission-focused filesystem discovery is commonly used by attackers to enumerate targets that may be misconfigured for privilege escalation or further probing. It relies on process creation telemetry with the Image path and CommandLine content.
references:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /find
    CommandLine|contains:
      - -perm -4000
      - -perm -2000
      - -perm 0777
      - -perm -222
      - -perm -o w
      - -perm -o x
      - -perm -u=s
      - -perm -g=s
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1