tfMITRE ATT&CK sub-technique

Setuid and Setgid T1548.001

sub-technique of T1548 Abuse Elevation Control Mechanism

Tactic: Privilege Escalation
Platforms: Linux, macOS
Version: 2.0
Created: 30 January 2020
Last modified: 12 May 2026

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.[1] Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules73rd pct

Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.

Setuid and Setgid MITRE reference T1548.001

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Exaramel for LinuxS0401 ↗

Can execute commands with high privileges via a specific binary with setuid functionality.1

created 2019-08-26MALWAREcarried by 1 group

KeydnapS0276 ↗

Adds the setuid flag to a binary so it can easily elevate in the future.1

created 2018-10-17MALWARE

All 2 software entries for this technique

Offense vs defense T1548.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 7

first rule: 2020 Q2

Setuid and Setgid detection strategy DET0110

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Setuid/Setgid Privilege Abuse Detection (Linux/macOS)

Enterprise

2 platforms

AN0307 · Linux

Correlation of chmod operations setting setuid/setgid bits followed by privileged process execution (EUID != UID), especially from user-writable or abnormal paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	auditd:SYSCALL	chmod, execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Track execution of setuid binaries where UID != EUID or executed from unexpected user context
FilePathScope	Restrict detection to non-standard locations (e.g., /tmp, /home/*, /var/tmp)
TimeWindow	Time delta between chmod setting setuid/gid and process execution to define a suspicious window

AN0308 · macOS

Observation of chmod commands setting setuid/setgid bits, paired with launch of binaries under elevated execution context (e.g., root-owned binaries launched by unprivileged users).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	macos:unifiedlog	exec of binary with setuid/setgid and EUID != UID
Command ExecutionDC0064	macos:unifiedlog	chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Monitor execution chains where UID != EUID or child process inherits root without known sudo context
ExecutionPath	Focus on binaries in user-writable locations or abnormal directories
ChmodPattern	Tailor detection to chmod commands that imply privilege elevation via numeric mode or symbolic mode

Tests10Executorssh 10Need elevation8 of 10Have prerequisites0Have cleanup8Platformsmacos, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Make and modify binary from C source macos, linux sh Required — Yes

Make, change owner, and change file attributes on a C source code file

Input arguments

Name	Type	Default	Description
payload	path	PathToAtomicsFolder/T1548.001/src/hello.c	hello.c payload

Attack command

cp #{payload} /tmp/hello.c
sudo chown root /tmp/hello.c
sudo make /tmp/hello
sudo chown root /tmp/hello
sudo chmod u+s /tmp/hello
/tmp/hello

Cleanup command

sudo rm /tmp/hello
sudo rm /tmp/hello.c

GUIDd411b588-cb30-4208-8ed5-9dac84e82f47

02 Make and modify binary from C source (freebsd) linux sh Required — Yes

Make, change owner, and change file attributes on a C source code file

Input arguments

Name	Type	Default	Description
payload	path	PathToAtomicsFolder/T1548.001/src/hello.c	hello.c payload

Attack command

cp #{payload} /tmp/hello.c
chown root /tmp/hello.c
make /tmp/hello
chown root /tmp/hello
chmod u+s /tmp/hello
/tmp/hello

Cleanup command

rm /tmp/hello
rm /tmp/hello.c

GUIDfa24efc1-b81f-4895-841a-8f4e90c0efb3

03 Set a SetUID flag on file macos, linux sh Required — Yes

This test sets the SetUID flag on a file in FreeBSD.

Input arguments

Name	Type	Default	Description
file_to_setuid	path	/tmp/evilBinary	Path of file to set SetUID flag

Attack command

sudo touch #{file_to_setuid}
sudo chown root #{file_to_setuid}
sudo chmod u+xs #{file_to_setuid}

Cleanup command

sudo rm #{file_to_setuid}

GUIDf1c20210-3f81-4d91-8623-2768991dbef9

04 Set a SetUID flag on file (freebsd) linux sh Required — Yes

This test sets the SetUID flag on a file in FreeBSD.

Input arguments

Name	Type	Default	Description
file_to_setuid	path	/tmp/evilBinary	Path of file to set SetUID flag

Attack command

touch #{file_to_setuid}
chown root #{file_to_setuid}
chmod u+xs #{file_to_setuid}

Cleanup command

rm #{file_to_setuid}

GUIDcef4aaad-6ce2-45b1-99bf-d61e136cd4d3

05 Set a SetGID flag on file macos, linux sh Required — Yes

This test sets the SetGID flag on a file in Linux and macOS.

Input arguments

Name	Type	Default	Description
file_to_setuid	path	/tmp/evilBinary	Path of file to set SetGID flag

Attack command

sudo touch #{file_to_setuid}
sudo chown root #{file_to_setuid}
sudo chmod g+xs #{file_to_setuid}

Cleanup command

sudo rm #{file_to_setuid}

GUIDd1f8672d-6afa-4d25-913e-a7f99fbe8c21

06 Set a SetGID flag on file (freebsd) linux sh Required — Yes

This test sets the SetGID flag on a file in FreeBSD.

Input arguments

Name	Type	Default	Description
file_to_setuid	path	/tmp/evilBinary	Path of file to set SetGID flag

Attack command

touch #{file_to_setuid}
chown root #{file_to_setuid}
chmod g+xs #{file_to_setuid}

Cleanup command

rm #{file_to_setuid}

GUID71ce5f2a-c8b5-48cb-8fbd-9c203254bb88

07 Make and modify capabilities of a binary linux sh Required — Yes

Make and modify capabilities of a C source code file. The binary doesn't have to modify the UID, but the binary is given the capability to arbitrarily modify it at any time with setuid(0). Without being owned by root, the binary can set the UID to 0.

Input arguments

Name	Type	Default	Description
payload	path	PathToAtomicsFolder/T1548.001/src/cap.c	cap.c payload

Attack command

cp #{payload} /tmp/cap.c
make /tmp/cap
sudo setcap cap_setuid=ep /tmp/cap
/tmp/cap

Cleanup command

rm /tmp/cap
rm /tmp/cap.c

GUID1cf9a288-d724-4230-9bc3-2c281427ad5d

08 Provide the SetUID capability to a file linux sh Required — Yes

This test gives a file the capability to set UID without using flags.

Input arguments

Name	Type	Default	Description
file_to_setcap	path	/tmp/evilBinary	Path of file to provide the SetUID capability

Attack command

touch #{file_to_setcap}
sudo setcap cap_setuid=ep #{file_to_setcap}

Cleanup command

rm #{file_to_setcap}

GUID2927e90a-8d6a-4159-af4b-b79712cd0b9b

09 Do reconnaissance for files that have the setuid bit set linux sh — — —

This test simulates a command that can be run to enumerate files that have the setuid bit set

Attack command

find /usr/bin -perm -4000

GUIDbf600091-730c-4f3a-b774-89206ba2d134

10 Do reconnaissance for files that have the setgid bit set linux sh — — —

This test simulates a command that can be run to enumerate files that have the setgid bit set

Attack command

find /usr/bin -perm -2000

GUID55aab00d-23a5-4983-960f-87b74154776f

Tests from Atomic Red Team (MIT licence) · technique definition

Setuid and Setgid detections T1548.001

9 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

73rd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs