AN0307
Analytic 0307
Linux
Correlation of chmod operations setting setuid/setgid bits followed by privileged process execution (EUID != UID), especially from user-writable or abnormal paths.
auditd:SYSCALL
chmod, execve
auditd:SYSCALL
execve
[UserContext]
Track execution of setuid binaries where UID != EUID or executed from unexpected user context
[FilePathScope]
Restrict detection to non-standard locations (e.g., /tmp, /home/*, /var/tmp)
[TimeWindow]
Time delta between chmod setting setuid/gid and process execution to define a suspicious window
AN0308
Analytic 0308
macOS
Observation of chmod commands setting setuid/setgid bits, paired with launch of binaries under elevated execution context (e.g., root-owned binaries launched by unprivileged users).
macos:unifiedlog
chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777
macos:unifiedlog
exec of binary with setuid/setgid and EUID != UID
[UserContext]
Monitor execution chains where UID != EUID or child process inherits root without known sudo context
[ExecutionPath]
Focus on binaries in user-writable locations or abnormal directories
[ChmodPattern]
Tailor detection to chmod commands that imply privilege elevation via numeric mode or symbolic mode