macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-12-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags macOS process executions of the /find binary where the command line contains specific permission-filtering arguments consistent with searching for sensitive filesystem permissions (e.g., setuid/setgid and world-writable/executable paths). Attackers often use find-based discovery to enumerate misconfigurations and identify potential privilege-escalation paths. The detection relies on process creation telemetry, matching the image path ending in /find and the presence of targeted -perm patterns in the command line.

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

Suspicious Credential String Enumeration via findstr to Temp Directory

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Windows: Notepad Password File Discovery via Process Creation

Linux process execution of shell via nice utility

macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Pivot detection · T1083 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-execution-of-find-with-setuid-setgid-or-world-writable-permission--85de3a19

title: "macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery"
id: 0ae22114-1f7c-42d5-9a62-3feb9803e0bd
related:
  - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
    type: similar
  - id: 85de3a19-b675-4a51-bfc6-b11a5186c971
    type: derived
status: test
description: This rule flags macOS process executions of the /find binary where the command line contains specific permission-filtering arguments consistent with searching for sensitive filesystem permissions (e.g., setuid/setgid and world-writable/executable paths). Attackers often use find-based discovery to enumerate misconfigurations and identify potential privilege-escalation paths. The detection relies on process creation telemetry, matching the image path ending in /find and the presence of targeted -perm patterns in the command line.
references:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /find
    CommandLine|contains:
      - -perm -4000
      - -perm -2000
      - -perm 0777
      - -perm -222
      - -perm -o w
      - -perm -o x
      - -perm -u=s
      - -perm -g=s
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL