Rule Info
Name
SUSP_Chmod_BinSh_Priv_Escalation_Oct26
Author
X__Junior
Description
Detects suspicious chmod on /bin/sh commonly used for privilege escalation via SUID/SGID bit setting
Score
70
Date
2026-10-03
Minimum Yara
3.5.0
Rule Hash
7850d55b630afb3f9bca2a5d6c1344d7
Tags
['SCRIPT', 'T1068', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
15
Clean (0 engines)
3
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR