chmod command sets the setuid or setgid bit on a file

Siemphony@siemphonymediumT1548.001unverified

Matches a command-line invocation of chmod (or the install utility) whose arguments request a setuid or setgid mode, which is the first half of AN0307: the moment a binary is marked to run as its owner rather than its caller. Both halves of the analytic are a correlation — chmod, then an execution where EUID differs from UID, inside a TimeWindow — and Sigma can neither join two events nor express a time window, so only the mode change is modelled and the privileged execution that follows must be pivoted to by hand. The mode list is MITRE's ChmodPattern knob, populated here with the symbolic form '+s' and the numeric special-bit modes seen most often; the FilePathScope knob is deliberately not applied, so the rule is not restricted to /tmp or /home and will also see setuid being set on system paths. It sees only chmod as a process: an installer or configuration-management module that calls the chmod(2) syscall directly, or a package manager that applies modes from package metadata, produces no execve and is invisible here. Requires an auditd rule arming the execve syscall (for example `-a always,exit -F arch=b64 -S execve`), which no mainstream distribution ships enabled, so an empty result means the syscall is not being recorded rather than that nothing happened. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0110, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/chmod" or FolderPath endswith "/install") and (ProcessCommandLine contains "+s" or ProcessCommandLine contains "4755" or ProcessCommandLine contains "4777" or ProcessCommandLine contains "4711" or ProcessCommandLine contains "4750" or ProcessCommandLine contains "4700" or ProcessCommandLine contains "6755" or ProcessCommandLine contains "6777" or ProcessCommandLine contains "2755" or ProcessCommandLine contains "2775" or ProcessCommandLine contains "2777"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/chmod" OR Image="*/install") AND (CommandLine="*+s*" OR CommandLine="*4755*" OR CommandLine="*4777*" OR CommandLine="*4711*" OR CommandLine="*4750*" OR CommandLine="*4700*" OR CommandLine="*6755*" OR CommandLine="*6777*" OR CommandLine="*2755*" OR CommandLine="*2775*" OR CommandLine="*2777*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/chmod" OR TO_LOWER(process.executable) LIKE "*/install") AND (TO_LOWER(process.command_line) LIKE "*+s*" OR TO_LOWER(process.command_line) LIKE "*4755*" OR TO_LOWER(process.command_line) LIKE "*4777*" OR TO_LOWER(process.command_line) LIKE "*4711*" OR TO_LOWER(process.command_line) LIKE "*4750*" OR TO_LOWER(process.command_line) LIKE "*4700*" OR TO_LOWER(process.command_line) LIKE "*6755*" OR TO_LOWER(process.command_line) LIKE "*6777*" OR TO_LOWER(process.command_line) LIKE "*2755*" OR TO_LOWER(process.command_line) LIKE "*2775*" OR TO_LOWER(process.command_line) LIKE "*2777*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/chmod$|/install$)</field>    <field name="CommandLine" type="pcre2">(?i)(\+s|4755|4777|4711|4750|4700|6755|6777|2755|2775|2777)</field>    <description>chmod command sets the setuid or setgid bit on a file</description>    <mitre>      <id>T1548.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: privilege_escalation_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 18414288-dabb-4d7a-96fe-a1bc7e2ea65b

ATT&CKT1548.001

T1548.001Setuid and Setgid

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprivilege escalation abuse

privilege escalation abuseAI draft — unreviewed

01 · What this rule detects

AN0307 describes a correlation, not an event: a chmod that sets the setuid or setgid bit, then — inside MITRE's TimeWindow knob — an execution where EUID differs from UID. Sigma joins nothing and expresses no window, so this rule implements the first half and stops. A hit means a file was marked to run as its owner. It does not mean anyone ran it. The consequence to carry away: abuse of a setuid binary that already exists — the common real case, where no chmod ever runs — produces nothing this rule can see.

02 · Telemetry you need

category: process_creation / product: linux, copied verbatim from the brief. In practice that is auditd's execve syscall, which no mainstream distribution arms by default; without a rule like -a always,exit -F arch=b64 -S execve the query returns zero rows, and zero rows here means blind, not quiet.
Of AN0308's three knobs only ChmodPattern is implementable on a single execve record. UserContext (UID != EUID) belongs to the execution leg, and ExecutionPath — sibling of AN0307's FilePathScope — is deliberately left unapplied, so the rule also sees setuid being set on system paths.

03 · How the logic works

Two selections, ANDed. selection_tool gates Image|endswith on /chmod and /install; install is there because install -m 4755 sets the bit without ever calling chmod. The leading slash anchors at a path boundary. selection_mode is the ChmodPattern knob rendered as a CommandLine|contains list. One entry, +s, covers the symbolic form generically. The other ten — 4755, 4777, 4711, 4750, 4700, 6755, 6777, 2755, 2775, 2777 — are the pipeline's own enumeration. MITRE names the knob; these values were chosen here. That enumeration is the weakest joint, and review flagged it. chmod 4775, chmod 4555, chmod 2750, chmod 6750 and chmod 4770 all set setuid or setgid and none match. Evasion costs one digit and no functionality. A regex over the mode argument — CommandLine|re: '(^|\s)0?[2467][0-7]{3}(\s|$)' — closes it where the backend renders re. Two further blind spots: on busybox hosts and minimal containers execve records exe=/bin/busybox with chmod as argv[0], so the tool selector never fires; and an installer or Ansible module calling chmod(2) directly produces no execve.

04 · Common false positives

Loudly, on the wrong estates. Build servers and CI runners compiling packages run install -m 4755 on ping, fusermount and mount helpers repeatedly — the rule's own first false positive calls this the largest benign source in most estates. Behind it: administrators reasserting the setuid bit on sudo, passwd or chsh after a permission audit, byte-identical to an operator marking a payload; chmod g+s /srv/projects, the standard way to make a shared directory inherit its group, matching the same +s; and CTF or pentest tooling that sets the bit on purpose.
level: medium is therefore fleet-dependent. On an estate containing build hosts it is hotter than the rule's own first entry supports.

05 · Detection maturity

tier_1: , and it stays there. Derived from a MITRE scaffold containing no query logic and never executed against a log line; tracing it on paper is analysis, not verification.
tier_2: run read-only for a fortnight, rank hits by host and by `Image`, and turn the top of that list into the host exclusion the rule lacks.
tier_3: ** pair it with an execution-side rule on UID != EUID and correlate the two downstream — the only shape that makes an alert mean privilege escalation rather than a permission change.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude build and CI hosts by host before this alerts. Treat that as a
Swap the numeric list for the regex above, or extend it to the full
Add /busybox to selection_tool if containers are in scope.
Apply FilePathScope only if you accept the trade: restricting to /tmp,
Tag attack.t1222.002 alongside — everything selected here is equally the

Declared by the author

Building software from source. Makefile install targets and container image builds run install -m 4755 or chmod 4755 on helpers that legitimately need setuid — ping, fusermount, mount helpers, pkexec-style wrappers — so any build server or CI runner compiling packages matches repeatedly, and this is the largest benign source in most estates.
Administrators reasserting permissions on system binaries. Restoring the setuid bit on /usr/bin/sudo, /usr/bin/passwd, /bin/ping or /usr/bin/chsh after a permission audit, a botched recursive chmod or a restore is done with exactly this command and is indistinguishable from an adversary marking a payload.
Setgid on shared directories. chmod g+s /srv/projects is the standard way to make a group-shared folder inherit its group, and it is routine on file servers and developer machines; it matches the same '+s' argument as a setuid binary.
Security training, CTF exercises and pentest tooling installation, which set setuid bits on purpose and will fire this rule on every run.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1548.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/18414288-dabb-4d7a-96fe-a1bc7e2ea65b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

chmod command sets the setuid or setgid bit on a file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it