This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Service Creation via Local Kerberos Authentication SharePoint Malware File Upload »
Elastic Docs ›Elastic Security Solution [master] ›Detections and alerts ›Prebuilt rule reference

Setuid / Setgid Bit Set via chmod

edit

Setuid / Setgid Bit Set via chmod

edit

An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they’re able to execute in elevated contexts in the future.

Rule type: query

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 33

Tags:

  • Elastic
  • Host
  • Linux
  • macOS
  • Threat Detection
  • Privilege Escalation

Version: 100 (version history)

Added (Elastic Stack release): 7.8.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule query

edit
event.category:process AND event.type:(start OR process_started) AND
process.name:chmod AND process.args:("+s" OR "u+s" OR /4[0-9]{3}/ OR
g+s OR /2[0-9]{3}/) AND NOT process.args: (
/.*\/Applications\/VirtualBox.app\/.+/ OR
/\/usr\/local\/lib\/python.+/ OR
/\/var\/folders\/.+\/FP.*nstallHelper/ OR
/\/Library\/Filesystems\/.+/ OR
/\/usr\/lib\/virtualbox\/.+/ OR
/\/Library\/Application.*/ OR "/run/postgresql" OR
"/var/crash" OR "/var/run/postgresql" OR
/\/usr\/bin\/.+/ OR /\/usr\/local\/share\/.+/ OR
/\/Applications\/.+/ OR /\/usr\/libexec\/.+/ OR
"/var/metrics" OR /\/var\/lib\/dpkg\/.+/ OR
/\/run\/log\/journal\/.*/ OR
\/Users\/*\/.minikube\/bin\/docker-machine-driver-hyperkit
) AND NOT process.parent.executable: (
/\/var\/lib\/docker\/.+/ OR "/System/Library/PrivateFrame
works/PackageKit.framework/Versions/A/XPCServices/package_script_servi
ce.xpc/Contents/MacOS/package_script_service" OR
"/var/lib/dpkg/info/whoopsie.postinst" )

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 100 (8.5.0 release)
  • Formatting only
Version 8 (7.13.0 release)

  • Updated query, changed from:

    event.category:process AND event.type:(start OR process_started) AND
process.name:chmod AND process.args:("+s" OR "u+s" OR /4[0-9]{3}/ OR
g+s OR /2[0-9]{3}/)
Version 7 (7.12.0 release)
  • Rule name changed from: Setuid Bit Set via chmod

  • Updated query, changed from:

    event.category:process AND event.type:(start or process_started) AND
process.name:chmod AND process.args:(u+s OR /4[0-9]{3}/) AND NOT
user.name:root
Version 6 (7.11.2 release)
  • Formatting only
Version 5 (7.11.0 release)
  • Formatting only
Version 4 (7.10.0 release)
  • Formatting only
Version 3 (7.9.1 release)
  • Formatting only
Version 2 (7.9.0 release)

  • Updated query, changed from:

    event.action:(executed OR process_started) AND process.name:chmod AND
process.args:(u+s OR /4[0-9]{3}/) AND NOT user.name:root
« Service Creation via Local Kerberos Authentication SharePoint Malware File Upload »