Detection of SUID/SGID Bit Modification for Privilege Escalation

Adversaries targeting Unix-like systems, including Linux and macOS, often abuse SUID (Set Owner User ID) and SGID (Set Group ID) bits to achieve privilege escalation or persistence. By setting these bits on a binary or script, an attacker ensures the file executes with the permissions of the file owner or group rather than the user invoking the file. This technique allows attackers to bypass standard access controls, exploit vulnerabilities in setuid applications, or execute their own malware in an elevated context. This activity is typically performed using command-line utilities such as chmod or install. Monitoring the execution of these utilities with flags that modify SUID/SGID bits is essential for detecting unauthorized privilege escalation attempts.

Impact

Successful abuse of SUID/SGID bits allows unauthorized users to gain elevated access, potentially leading to full system compromise. If an attacker gains the ability to execute code as root or a high-privileged service user, they can bypass security restrictions, exfiltrate sensitive data, or establish long-term persistence that survives system reboots and user session termination.

Recommendation

Detection engineering teams should monitor for the unauthorized use of chmod and install commands to set SUID/SGID bits.

• Implement the provided Sigma rule to alert on suspicious chmod/install command arguments.
• Establish a baseline of legitimate SUID/SGID modifications performed by automated package managers or deployment scripts to reduce noise.
• Audit file systems for unexpected files with the SUID or SGID bits set, particularly in directories writable by non-privileged users.
• Correlate chmod events with other suspicious activity from the same user or process hierarchy to identify malicious intent versus administrative maintenance.