Detecting SUID and SGID Abuse on Linux: Enumeration, Creation and Execution

The setuid and setgid bits let a program run as its owner or group, and attackers abuse them in two ways: finding an existing SUID binary that can be coerced into a shell (T1548.001), or setting the bit on a binary they control to keep root access. Both leave clear traces if you audit for them: the enumeration, the chmod, and the execution where effective and real identity differ.

Signals at a Glance

Watching Creation and Execution

Two audit rules cover most of the behaviour. The first records any call that sets the setuid bit (04000 is 0x800 in the mode argument). The second records execution where the effective user is root but the real user is not, which is what a working SUID escalation looks like:

# /etc/audit/rules.d/suid.rules
-a always,exit -F arch=b64 -S chmod,fchmod -F a1&0x800 -k suid_set
-a always,exit -F arch=b64 -S fchmodat -F a2&0x800 -k suid_set
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid_exec
-w /usr/bin/find -p x -k suid_enum
# tune/validate: setuid_exec fires for sudo, su, passwd and ping; baseline those before alerting.

Inventory, Diff and Shell Flags

An inventory makes the unusual visible. Take a baseline of SUID files per host class, then alert on additions and on any binary in a GTFOBins-listed set that carries the bit. In osquery:

-- osquery: SUID inventory with differential scheduling (alert on added rows)
SELECT s.path, s.username, s.groupname, s.permissions, h.sha256
FROM suid_bin s
JOIN hash h ON h.path = s.path;
-- tune/validate: schedule as a differential query and review additions by hash.

title: Shell Started with Privilege-Preserving Flag
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
    CommandLine|contains: ' -p'
  condition: selection
level: medium
# tune/validate: legitimate use is rare; correlate with parent binaries such as find, env or python.

• Remove the setuid bit from binaries that do not need it. Common candidates are older nmap builds, editors and archive tools left from a distribution image.
• Mount user-writable filesystems such as /tmp, /home and /var/tmp with nosuid so a planted SUID file is inert.
• Hash and sign the approved SUID set in your golden image, so any addition is a hash mismatch rather than a judgement call.