Setuid and Setgid
An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application....
BY SOURCE
PROCEDURES (9)
Auto-extracted: 9 detections for general monitoring
Auto-extracted: 3 detections for persist
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for authentication monitoring
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for persist