T1548.001Privilege Escalation
Setuid and Setgid
An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively. Normally an application is run in the…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
2 Sigma rules tagged T1548.001Setuid and SetgidT1548.0012 general rules
- PwnKit Local Privilege Escalationhightest
- Setuid and Setgidlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Setuid and Setgid
2 CVEs, by priority. Each link shows its badge.- CVE-2023-0386Linux Kernel Improper Ownership Management VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1543Create or Modify System ProcessT1548.001Setuid and SetgidMITRE CTID mapping of the KEV entry · how it is exploited7.9%Top 5.3%67.4priority
- CVE-2020-3950VMware Multiple Products Privilege Escalation VulnerabilityVMware · Multiple ProductsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548.001Setuid and SetgidAI mapping from the description · primary impact7.3%Top 5.7%67.3priority