description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line ...

description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This ...

When you run an executable file in Linux, it usually runs with the current user and group ID. However, there are times when you need to run that file as another user (like root). Instead of switching ...