macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags macOS process executions of the /find binary where the command line contains specific permission-filtering arguments consistent with searching for sensitive filesystem permissions (e.g., setuid/setgid and world-writable/executable paths). Attackers often use find-based discovery to enumerate misconfigurations and identify potential privilege-escalation paths. The detection relies on process creation telemetry, matching the image path ending in /find and the presence of targeted -perm patterns in the command line.

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Windows: Notepad Password File Discovery via Process Creation

Linux process execution of shell via nice utility

Linux: Shell Command Execution Using flock -u with Common Shell Paths

Linux Find Command Used to Execute a Shell via -exec

Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper

Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes

macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Pivot detection · T1083 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-execution-of-find-with-setuid-setgid-or-world-writable-permission--85de3a19

title: "macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery"
id: 0ae22114-1f7c-42d5-9a62-3feb9803e0bd
related:
  - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
    type: similar
  - id: 85de3a19-b675-4a51-bfc6-b11a5186c971
    type: derived
status: test
description: This rule flags macOS process executions of the /find binary where the command line contains specific permission-filtering arguments consistent with searching for sensitive filesystem permissions (e.g., setuid/setgid and world-writable/executable paths). Attackers often use find-based discovery to enumerate misconfigurations and identify potential privilege-escalation paths. The detection relies on process creation telemetry, matching the image path ending in /find and the presence of targeted -perm patterns in the command line.
references:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-28
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /find
    CommandLine|contains:
      - -perm -4000
      - -perm -2000
      - -perm 0777
      - -perm -222
      - -perm -o w
      - -perm -o x
      - -perm -u=s
      - -perm -g=s
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL