Capabilities Discovery - Linux

Hunt Hypothesis

Detects usage of “getcap” binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Detection Rule

Sigma (Original)

title: Capabilities Discovery - Linux
id: d8d97d51-122d-4cdd-9e2f-01b4b4933530
status: test
description: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.
references:
    - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
    - https://github.com/carlospolop/PEASS-ng
    - https://github.com/diego-treitos/linux-smart-enumeration
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-28
modified: 2026-01-24
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/getcap'
        CommandLine|contains: ' -r '
    condition: selection
falsepositives:
    - Unknown
level: low

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName endswith "/getcap" and TargetProcessCommandLine contains " -r "

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Discovery
• Technique: T1083 — File and Directory Discovery

  Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [F

Validation (Atomic Red Team)

Use these Atomic Red Team tests to validate this detection fires correctly:

• T1083 — File and Directory Discovery

References

• https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
• https://github.com/carlospolop/PEASS-ng
• https://github.com/diego-treitos/linux-smart-enumeration
• SigmaHQ Rule