Home/ MITRE Matrix/ Privilege Escalation/ T1548.001

T1548.001Setuid and Setgid

T1548.001 — Setuid and Setgid is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 11 detection use cases covering it and 3 threat-intel articles citing it.

Privilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

11Use cases

3Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1548 · Abuse Elevation Control Mechanism

Use cases covering this technique (11)

Linux Auditd Setuid Using Chmod Utility ESCU actions · hunting P Linux Auditd Setuid Using Setcap Utility ESCU actions · alerting P Linux Common Process For Elevation Control ESCU actions · hunting P Linux Dirty Frag Kernel Privilege Escalation ESCU actions · alerting P Linux Setuid Using Chmod Utility ESCU actions · hunting P Linux Setuid Using Setcap Utility ESCU actions · hunting P Linux Usermod Root UID Set ESCU actions · alerting P [LLM] SleeperGem privilege escalation: setuid-root shell planted as /usr/local/sbin/ping6 Bespoke install · alerting DSΣPDDCS [LLM] Dirty Pipe SUID hijack: root-privileged process executing from /tmp or /dev/shm Bespoke exploit · alerting DSΣPDDCS [LLM] PwnKit pkexec executed with empty argv (CVE-2021-4034 exploit primitive) Bespoke exploit · alerting DSΣPDDCS [LLM] Root shell spawned by pkexec with empty parent command line (PwnKit post-exploitation) Bespoke install · alerting DSΣPCS

Articles citing this technique (3)

high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2501

high Analyzing the PwnKit local privilege escalation exploit art-2677