Set Setuid or Setgid bit

rule: Set Setuid or Setgid bit
desc: 'This rule is focused on detecting the use of setuid or setgid bits set via
  chmod. These bits, when set for an application, result in the application running
  with the privileges of the owning user or group. By enabling the setuid or setgid
  bits, an attacker could run code in a different user''s context, possibly with elevated
  privileges. However, there''s a trade-off with noise, given that numerous applications
  legitimately run chmod. This rule is related to the "Non sudo setuid" rule.

  '
condition: 'chmod and (evt.arg.mode contains "S_ISUID" or evt.arg.mode contains "S_ISGID")
  and not proc.name in (user_known_chmod_applications) and not exe_running_docker_save
  and not user_known_set_setuid_or_setgid_bit_conditions

  '
output: Setuid or setgid bit is set via chmod | fd=%evt.arg.fd filename=%evt.arg.filename
  mode=%evt.arg.mode evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- process
- users
- mitre_privilege_escalation
- T1548.001