This is a proposal for SUID Enumeration Using Find

[mlakri]

The goal is to detect the execution of the find command in auditd logs (e.g., $find /usr/bin -type f -perm -4001) when searching for binaries or scripts that can be executed with elevated privileges, or when used for reconnaissance to discover details about file permissions or access conditions to sensitive data.

Changelog

type=EXECVE msg=audit(1731503214.337:71048): argc=6 a0="find" a1="/usr/bin" a2="-type" a3="f" a4="-perm" a5="-4001"

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @mlakri 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[nasbench]

Hey @mlakri and thanks for your contribution.

Can you please provide log data for your example. And also looking for specific permission isn't a direct sign of privilege escalation. It's just permission discovery, the outcome could be exfiltration, recon or privesc for privesc. So the metadata fro the rule (description and title) should reflect that.

Please take this into consideration and make the necessary changes.

[mlakri]

Hello @nasbench
I removed everything related to "PrivEsc," leaving its meaning to refer only to enumeration.
Additionally, I added an example of an EXECVE log.