SUID Bit Set on Shell via Chmod for Privilege Escalation

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects chmod being used to set the SUID bit on a file, a common post-exploitation technique for privilege escalation on Linux. After gaining low-privileged code execution (e.g. as nobody or www-data), attackers copy a shell binary or custom backdoor to a writable path, set the SUID bit so it executes as root, then invoke it to obtain a root shell.

2026-10-05 00:00:00

None

fe929777-6e92-4d01-8e88-7bd4a4aeb2ff

attack.privilege-escalation attack.t1548.001

Nextron Sigma feed only (private)