Linux Capabilities Discovery with getcap
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
Sigma
