SUID Binary Execution Followed by Persistence Mechanism Creation

Danny Y@zendannyy

•updated Apr 26, 2026•2•0•345

This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.