Linux Capabilities Discovery via getcap
This rule detects the execution of the 'getcap' binary on Linux systems. Adversaries often use 'getcap' during reconnaissance to identify binaries with special capabilities that could be exploited for privilege escalation, such as GTFOBins or other vulnerable executables. The rule specifically looks for the use of 'getcap' with the '-r' flag, which recursively lists capabilities.
Sigma
