Abuse Elevation Control Mechanism: Setuid and Setgid `T1548.001`

Tactic: Privilege Escalation

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively. Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.

Events covered

7 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1321	BPRM_FCAPS
Linux-Auditd	Event ID 1327	PROCTITLE
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 44 rules share fields, values, and exclusions.

Fields filtered most (47 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	32	`eq` 29, `in` 5	`exec`, `uid_change`, `executed`, `exec_event`, `ProcessRollup2`
`event.type`	29	`eq` 28, `in` 1	`start`, `change`, `creation`
`process_name`	26	`eq` 18, `in` 10, `starts_with` 3, `contains` 1, `is_not_null` 1, `regex_match` 1	`chmod`, `bash`, `setcap`, `.`, `aa-exec`
`host.os.type`	22	`eq` 22
`process.args`	18	`in` 10, `eq` 9, `starts_with` 3, `wildcard` 2, `contains` 1, `regex_match` 1	`+x`, `--command`, `-2000`, `-4000`, `-6000`
`user.id`	13	`eq` 9, `ne` 9, `is_not_null` 1	`0`
`ParentImage`	10	`wildcard` 9, `is_not_null` 1	`/dev/shm/`, `/home//`, `./`, `.`, `/var/lib/dpkg/info/.postinst`
`CommandLine`	9	`contains` 5, `in` 4, `match` 1, `regex_match` 1, `starts_with` 1	`chmod g+s`, `chmod u+s`, `(?i)(^chmod\s+([-fhvrlp]+\s+)?((([01234567]{1,1})?([1357]...`, `* -u 0`, `* -u 0 *`
`Image`	9	`wildcard` 4, `starts_with` 3, `is_not_null` 2, `contains` 1	`/dev/shm/`, `/home//`, `.`, `process.command_line`, `/dev/shm/`
`process.group.id`	9	`eq` 9	`0`
`process.real_group.id`	9	`ne` 9	`0`
`process.real_user.id`	9	`ne` 9	`0`
`process.user.id`	9	`eq` 9	`0`
`parent_process_name`	8	`in` 8, `wildcard` 5	`bash`, `.*`, `bun`, `csh`, `dash`
`process.parent.args_count`	7	`le` 5, `eq` 2	`4`, `1`

Top indicator values (620 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential SUID/SGID Files Enumeration +12 more rules	27	1087
`event.type`	`eq`	`change` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Elevation from Previously Unknown Executable	8	95
`EventType`	`eq`	`exec` elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential SUID/SGID Files Enumeration +10 more rules	25	579
`EventType`	`eq`	`uid_change` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Elevation from Previously Unknown Executable	6	19
`process.group.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	10
`process.real_group.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	9
`process.real_user.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	9
`process.user.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	10
`user.id`	`eq`	`0` elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Elevation from Previously Unknown Executable	9	28
`user.id`	`ne`	`0` elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential SUID/SGID Files Enumeration elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticSuspicious SUID Binary Execution (Auditd Sequence)	9	28
`ParentImage`	`wildcard`	`/dev/shm/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	17
`ParentImage`	`wildcard`	`/home//` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	18
`ParentImage`	`wildcard`	`/run/user/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	16
`ParentImage`	`wildcard`	`/tmp/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	19
`ParentImage`	`wildcard`	`/var/run/user/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	16
`ParentImage`	`wildcard`	`/var/tmp/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	19
`ParentImage`	`wildcard`	`./*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	5	7
`parent_process_name`	`in`	`bash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	66
`parent_process_name`	`in`	`csh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	40
`parent_process_name`	`in`	`dash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	43
`parent_process_name`	`in`	`fish` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	41
`parent_process_name`	`in`	`ksh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	41
`parent_process_name`	`in`	`sh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	66
`parent_process_name`	`in`	`tcsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	41
`parent_process_name`	`in`	`zsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	8	64
`parent_process_name`	`in`	`mksh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	5	10
`process.parent.group.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution	7	11
`process.parent.user.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution	7	13
`parent_process_name`	`wildcard`	`.*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	5	11
`parent_process_name`	`wildcard`	`bun` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	5	5

Exclusions (347 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`in`	`/usr/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	4
`Image`	`in`	`/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`process_name`	`in`	`sudo` elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Elevation from Previously Unknown Executable	3
`Image`	`eq`	`/usr/bin/sudo` elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID/SGID Utility Execution	2
`Image`	`starts_with`	`/bin/` elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticUID Elevation from Previously Unknown Executable	2
`Image`	`starts_with`	`/run/k3s/containerd/` elasticShell Privileged Mode from Non-Standard Path with Root Effective User elasticUID Elevation from Previously Unknown Executable	2
`Image`	`starts_with`	`/sbin/` elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticUID Elevation from Previously Unknown Executable	2
`Image`	`starts_with`	`/usr/bin/` elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticUID Elevation from Previously Unknown Executable	2
`Image`	`starts_with`	`/usr/sbin/` elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticUID Elevation from Previously Unknown Executable	2
`ParentImage`	`in`	`/usr/bin/update-notifier` elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	2
`ParentImage`	`wildcard`	`/tmp/newroot/*` elasticSUID/SGID Bit Set elasticSystem Binary Path File Permission Modification	2
`parent_process_name`	`in`	`jem` elasticSetcap setuid/setgid Capability Set elasticSetcap setuid/setgid Capability Set	2
`parent_process_name`	`in`	`sudo` elasticPotential Privilege Escalation via SUID Binary elasticSystem Binary Path File Permission Modification	2
`parent_process_name`	`in`	`vzctl` elasticSetcap setuid/setgid Capability Set elasticSetcap setuid/setgid Capability Set	2
`process.args`	`eq`	`-xdev` elasticPotential SUID/SGID Files Enumeration elasticSUID/SGUID Enumeration Detected	2

Abuse Elevation Control Mechanism: Setuid and Setgid `T1548.001`

Events covered

Authoring guide

Fields filtered most (47 distinct)

Top indicator values (620 distinct)

Exclusions (347 distinct)

Rules under this technique

Sigma 3 rules

Elastic 32 rules

Splunk 9 rules

Abuse Elevation Control Mechanism: Setuid and Setgid T1548.001

Events covered

Authoring guide

Fields filtered most (47 distinct)

Top indicator values (620 distinct)

Exclusions (347 distinct)

Rules under this technique

Sigma 3 rules

Elastic 32 rules

Splunk 9 rules

Abuse Elevation Control Mechanism: Setuid and Setgid `T1548.001`