Linux Setcap Assuming All Capabilities
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file. This capability can be abused to create a backdoored binary, for privilege escalation, and bypassing security controls.
Sigma
