Linux Setuid or Setgid Permission Change
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation. 2 is the special bit for SGID 4 is the special bit for SetUID 6 combines the special bits for SetUID and SGID
Sigma
