Home/ MITRE Matrix/ Privilege Escalation/ T1548.001

T1548.001Setuid and Setgid

T1548.001 — Setuid and Setgid is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 12 detection use cases covering it and 5 threat-intel articles citing it.

Privilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

12Use cases

5Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1548 · Abuse Elevation Control Mechanism

Use cases covering this technique (12)

Linux Auditd Setuid Using Chmod Utility ESCU actions · hunting P Linux Auditd Setuid Using Setcap Utility ESCU actions · alerting P Linux Common Process For Elevation Control ESCU actions · hunting P Linux Dirty Frag Kernel Privilege Escalation ESCU actions · alerting P Linux Setuid Using Chmod Utility ESCU actions · hunting P Linux Setuid Using Setcap Utility ESCU actions · hunting P [LLM] LinPEAS / SUID sweep privilege-escalation enumeration on Linux Bespoke exploit · hunting DSΣPDDCS [LLM] SleeperGem privilege escalation: setuid-root shell planted as /usr/local/sbin/ping6 Bespoke install · alerting DSΣPDDCS [LLM] Node extraction writing ld.so.preload or setuid/privileged path as root (CVE-2026-53486 privesc) Bespoke install · alerting DSΣDDCS [LLM] Dirty Pipe SUID hijack: root-privileged process executing from /tmp or /dev/shm Bespoke exploit · alerting DSΣPDDCS [LLM] PwnKit pkexec executed with empty argv (CVE-2021-4034 exploit primitive) Bespoke exploit · alerting DSΣPDDCS [LLM] Root shell spawned by pkexec with empty parent command line (PwnKit post-exploitation) Bespoke install · alerting DSΣPCS

Articles citing this technique (5)

crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-105

high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-141

crit [GHSA / CRITICAL] CVE-2026-53486: Decompress: Archive extraction can create files and links outside of the target directory art-240

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2478

high Analyzing the PwnKit local privilege escalation exploit art-2654