Suspicious Setuid/Setgid Bit Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•24

Detects suspicious changes to file privileges using `chown` to set ownership to root and `chmod` to enable setuid (u+s) or setgid (g+s) bits. This activity can be indicative of privilege escalation or persistence mechanisms where an adversary attempts to run code with elevated privileges.