{"id":"T1083","name":"File and Directory Discovery","url":"https://attack.mitre.org/techniques/T1083","tactics":["discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0370","stix_id":"x-mitre-detection-strategy--33ab9d0c-5671-48e6-8465-f80560909c65","name":"Recursive Enumeration of Files and Directories Across Privilege Contexts","url":"https://attack.mitre.org/detectionstrategies/DET0370","analytics":[{"id":"AN1040","stix_id":"x-mitre-analytic--69d9d158-aa43-4b73-b9a4-f1a2dc6c13c1","name":"Analytic 1040","description":"Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1040","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CommandLineRegex","description":"Allows tuning based on tools/scripts used for enumeration (e.g., tree, dir /s /b)"},{"field":"UserContext","description":"Scoping for standard vs elevated or service accounts"},{"field":"TimeWindow","description":"Defines burst activity over short periods (e.g., >50 directory queries in 30s)"}],"live":true,"detection_strategies":["DET0370"],"techniques":["T1083"]},{"id":"AN1041","stix_id":"x-mitre-analytic--b50bf863-644a-48c2-85a3-2c633f135650","name":"Analytic 1041","description":"Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1041","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PATH","channel":"PATH","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-path"}],"mutable_elements":[{"field":"FilePathDepth","description":"Max depth of recursive access to tune noise vs anomaly"},{"field":"UserContext","description":"Helpful to exclude known scripts or automation accounts"}],"live":true,"detection_strategies":["DET0370"],"techniques":["T1083"]},{"id":"AN1042","stix_id":"x-mitre-analytic--42683860-d6df-4585-af65-31f783269f8f","name":"Analytic 1042","description":"Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1042","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log collect --predicate","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"Filesystem Call Monitoring","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"PredicateScope","description":"Adjust macOS unified log filter to include/exclude system paths"},{"field":"TimeWindow","description":"Tune based on burst access patterns"}],"live":true,"detection_strategies":["DET0370"],"techniques":["T1083"]},{"id":"AN1043","stix_id":"x-mitre-analytic--aaddc766-52bb-428b-98c4-3a742d10befa","name":"Analytic 1043","description":"Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1043","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"Shell Access/Command Execution","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"vSphere File API Access","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"CLICommandPattern","description":"Match on esxcli storage|filesystem commands"},{"field":"AccessSource","description":"Limit alerting to non-vCenter or remote IPs"}],"live":true,"detection_strategies":["DET0370"],"techniques":["T1083"]},{"id":"AN1044","stix_id":"x-mitre-analytic--be6e5f23-0e29-430f-83f7-d76c58de3a2d","name":"Analytic 1044","description":"Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1044","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"CLI Command Logging","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CommandWhitelist","description":"Filter allowed commands by account or IP"},{"field":"SessionOrigin","description":"Tunable to restrict detection to remote terminal or Telnet/SSH"}],"live":true,"detection_strategies":["DET0370"],"techniques":["T1083"]}],"live":true,"version":"1.0","techniques":["T1083"]}],"sigma_rules":[{"id":"089dbdf6-b960-4bcc-90e3-ffc3480c20f6","title":"File and Directory Discovery - MacOS","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"informational","date":"2020-10-19","modified":"2022-11-25","description":"Detects usage of system utilities to discover files and directories","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml","techniques":["T1083"],"cves":[]},{"id":"093d68c7-762a-42f4-9f46-95e79142571a","title":"Shell Execution via Nice - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the \"nice\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/nice/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml","techniques":["T1083"],"cves":[]},{"id":"162e69a7-7981-4344-84a9-0f1c9a217a52","title":"Powershell Directory Enumeration","author":"frack113","status":"test","level":"medium","date":"2022-03-17","modified":null,"description":"Detects technique used by MAZE ransomware to enumerate directories using Powershell","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md","https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1083"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml","techniques":["T1083"],"cves":[]},{"id":"38646daa-e78f-4ace-9de0-55547b2d30da","title":"PUA - Seatbelt Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-18","modified":"2023-02-04","description":"Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters","references":["https://github.com/GhostPack/Seatbelt","https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1526","attack.t1087","attack.t1083"],"path":"rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","techniques":["T1526","T1087","T1083"],"cves":[]},{"id":"3b4e950b-a3ea-44d3-877e-432071990709","title":"Notepad Password Files Discovery","author":"The DFIR Report","status":"experimental","level":"low","date":"2025-02-21","modified":null,"description":"Detects the execution of Notepad to open a file that has the string \"password\" which may indicate unauthorized access to credentials or suspicious activity.","references":["https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/","https://intel.thedfirreport.com/eventReports/view/57"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml","techniques":["T1083"],"cves":[]},{"id":"41d40bff-377a-43e2-8e1b-2e543069e079","title":"WannaCry Ransomware Activity","author":"Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2019-01-16","modified":"2025-10-18","description":"Detects WannaCry ransomware activity","references":["https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100","https://x.com/nas_bench/status/1868639048484425963"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.defense-impairment","attack.t1210","attack.discovery","attack.t1083","attack.t1222.001","attack.impact","attack.t1486","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml","techniques":["T1210","T1083","T1222.001","T1486","T1490"],"cves":[]},{"id":"44030449-b0df-4c94-aae1-502359ab28ee","title":"PUA - TruffleHog Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-09-24","modified":null,"description":"Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1083","attack.t1552.001"],"path":"rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml","techniques":["T1083","T1552.001"],"cves":[]},{"id":"4b09c71e-4269-4111-9cdd-107d8867f0cc","title":"Shell Execution via Flock - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the \"flock\" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/flock/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml","techniques":["T1083"],"cves":[]},{"id":"6adfbf8f-52be-4444-9bac-81b539624146","title":"Shell Execution via Find - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.\n","references":["https://gtfobins.github.io/gtfobins/find/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml","techniques":["T1083"],"cves":[]},{"id":"7ab8f73a-fcff-428b-84aa-6a5ff7877dea","title":"Vim GTFOBin Abuse - Linux","author":"Nasreddine Bencherchali (Nextron Systems), Luc Génaux","status":"test","level":"high","date":"2022-12-28","modified":"2026-06-05","description":"Detects the use of \"vim\" and it's siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/vi/","https://gtfobins.github.io/gtfobins/vim/","https://gtfobins.github.io/gtfobins/rvim/","https://gtfobins.github.io/gtfobins/vimdiff/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1059","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml","techniques":["T1059","T1083"],"cves":[]},{"id":"7d416556-6502-45b2-9bad-9d2f05f38997","title":"Powershell Sensitive File Discovery","author":"frack113","status":"test","level":"medium","date":"2022-09-16","modified":null,"description":"Detect adversaries enumerate sensitive files","references":["https://twitter.com/malmoeb/status/1570814999370801158"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1083"],"path":"rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml","techniques":["T1083"],"cves":[]},{"id":"8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf","title":"Potential Discovery Activity Using Find - Linux","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-28","modified":null,"description":"Detects usage of \"find\" binary in a suspicious manner to perform discovery","references":["https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml","techniques":["T1083"],"cves":[]},{"id":"85de3a19-b675-4a51-bfc6-b11a5186c971","title":"Potential Discovery Activity Using Find - MacOS","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-28","modified":null,"description":"Detects usage of \"find\" binary in a suspicious manner to perform discovery","references":["https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml","techniques":["T1083"],"cves":[]},{"id":"953d460b-f810-420a-97a2-cfca4c98e602","title":"Source Code Enumeration Detection by Keyword","author":"James Ahearn","status":"test","level":"medium","date":"2019-06-08","modified":"2022-10-05","description":"Detects source code enumeration that use GET requests by keyword searches in URL strings","references":["https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html","https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1"],"logsource":{"category":"webserver"},"tags":["attack.discovery","attack.t1083"],"path":"rules/web/webserver_generic/web_source_code_enumeration.yml","techniques":["T1083"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"9b5de532-a757-4d70-946c-1f3e44f48b4d","title":"Shell Execution GCC  - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the \"gcc\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/gcc/#shell","https://gtfobins.github.io/gtfobins/c89/#shell","https://gtfobins.github.io/gtfobins/c99/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml","techniques":["T1083"],"cves":[]},{"id":"b4dc61f5-6cce-468e-a608-b48b469feaa2","title":"DirLister Execution","author":"frack113","status":"test","level":"low","date":"2022-08-20","modified":"2023-02-04","description":"Detect the usage of \"DirLister.exe\" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md","https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/windows/process_creation/proc_creation_win_dirlister_execution.yml","techniques":["T1083"],"cves":[]},{"id":"bb382fd5-b454-47ea-a264-1828e4c766d6","title":"Shell Invocation via Apt - Linux","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-28","modified":"2024-09-02","description":"Detects the use of the \"apt\" and \"apt-get\" commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/apt/","https://gtfobins.github.io/gtfobins/apt-get/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml","techniques":["T1083"],"cves":[]},{"id":"c601f20d-570a-4cde-a7d6-e17f99cb8e7f","title":"Turla Group Lateral Movement","author":"Markus Neis","status":"test","level":"critical","date":"2017-11-07","modified":"2022-10-09","description":"Detects automated lateral movement by Turla group","references":["https://securelist.com/the-epic-turla-operation/65545/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.g0010","attack.execution","attack.t1059","attack.lateral-movement","attack.t1021.002","attack.discovery","attack.t1083","attack.t1135","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_commands_critical.yml","techniques":["T1059","T1021.002","T1083","T1135"],"cves":[]},{"id":"d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72","title":"File and Directory Discovery - Linux","author":"Daniil Yugoslavskiy, oscd.community, CheraghiMilad","status":"test","level":"informational","date":"2020-10-19","modified":"2024-12-01","description":"Detects usage of system utilities such as \"find\", \"tree\", \"findmnt\", etc, to discover files, directories and network shares.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml","techniques":["T1083"],"cves":[]},{"id":"d7a650c4-226c-451e-948f-cc490db506aa","title":"PUA - TruffleHog Execution - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-09-24","modified":null,"description":"Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n","references":["https://github.com/trufflesecurity/trufflehog","https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.credential-access","attack.t1083","attack.t1552.001"],"path":"rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml","techniques":["T1083","T1552.001"],"cves":[]},{"id":"d8d97d51-122d-4cdd-9e2f-01b4b4933530","title":"Capabilities Discovery - Linux","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-12-28","modified":"2026-01-24","description":"Detects usage of \"getcap\" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.","references":["https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes","https://github.com/carlospolop/PEASS-ng","https://github.com/diego-treitos/linux-smart-enumeration"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml","techniques":["T1083"],"cves":[]},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","techniques":["T1082","T1057","T1012","T1083","T1007"],"cves":[]},{"id":"fe10751f-1995-40a5-aaa2-c97ccb4123fe","title":"Linux Capabilities Discovery","author":"Pawel Mazur","status":"test","level":"low","date":"2021-11-28","modified":"2022-12-25","description":"Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.","references":["https://man7.org/linux/man-pages/man8/getcap.8.html","https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/","https://mn3m.info/posts/suid-vs-capabilities/","https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.privilege-escalation","attack.t1083","attack.t1548"],"path":"rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml","techniques":["T1083","T1548"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2017-12637","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-53704","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-22952","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-19781","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-11510","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}