[New Rule] SUID/SGUID Enumeration Detected

[Aegrah]

Summary

This rule monitors for the usage of the "find" command in conjunction with SUID and SGUID permission arguments. SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow a program to execute with the privileges of the file owner or group, respectively, rather than the privileges of the user running the program. Attackers can leverage these permissions to escalate privileges by exploiting vulnerabilities or built-in features in the privileged program.

Detection

The rule was tested in RedSector, and shows 0 hits in the last 365 days. However, tools such as linpeas and linenum are detected through this logic.

process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
process.name == "find" and process.args : "-perm" and process.args : (
"/6000", "-6000", "/4000", "-4000", "/2000", "-2000", "/u=s", "-u=s", "/g=s", "-g=s", "/u=s,g=s", "/g=s,u=s"
) and not user.Ext.real.id : "0" and not group.Ext.real.id : "0"

[w0rk3r]

We could focus a bit more on the enumeration here

[Aegrah]

Added an additional line to the description that talks about enumeration.

[w0rk3r]

Awesome 🧙🏼

[brokensound77]

LGTM