T1548.001sub-technique of T1548 Abuse Elevation Control Mechanism

Setuid and Setgid

Linux · macOSnothing on this site yetT1548.001 on attack.mitre.org

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Setuid/Setgid Privilege Abuse Detection (Linux/macOS)

Correlation of chmod operations setting setuid/setgid bits followed by privileged process execution (EUID != UID), especially from user-writable or abnormal paths.
Observation of chmod commands setting setuid/setgid bits, paired with launch of binaries under elevated execution context (e.g., root-owned binaries launched by unprivileged users).

what reduces it

M1028 Operating System Configuration. Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system.

the rest of T1548

T1548.002 Bypass User Account Control · not covered yet
T1548.003 Sudo and Sudo Caching · not covered yet
T1548.004 Elevated Execution with Prompt · not covered yet
T1548.005 Temporary Elevated Cloud Access · not covered yet
T1548.006 TCC Manipulation · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.