Abuse of SUID and SGID Binaries

Overview

Abuse of SUID (Set User ID) and SGID (Set Group ID) binaries is a technique where adversaries exploit executables with elevated privileges to execute arbitrary code with those privileges. This method is commonly used during privilege escalation and lateral movement phases of an attack to gain unauthorized access or maintain persistence on a system.

Attack Objective

• Gain elevated privileges or unauthorized access
• Supports Privilege Escalation, Persistence, and Lateral Movement stages
• Advances attacker’s position by leveraging trusted binaries to execute code with higher privileges, bypassing normal access controls

How the Technique Works

On Unix-like systems, SUID and SGID bits on binaries allow users to run executables with the permissions of the file owner or group, typically root or another privileged user. Adversaries identify and exploit vulnerable or misconfigured SUID/SGID binaries to execute commands or scripts with elevated privileges, enabling them to bypass security restrictions without requiring direct root access.

Common Methods & Variations

• Exploiting known vulnerable SUID/SGID binaries to spawn shells or execute commands
• Modifying or replacing writable SUID/SGID binaries to execute malicious payloads
• On-premises systems primarily targeted; cloud environments may involve containerized or virtualized instances with similar privilege models
• Use of legitimate system binaries (living-off-the-land) versus custom or modified binaries

Indicators of Compromise (IOCs)

• Unexpected execution of SUID/SGID binaries outside normal usage patterns
• Unusual process spawning or command execution with elevated privileges
• File system changes to SUID/SGID binaries, including permission or ownership modifications
• Logs showing privilege escalations or anomalous user activity involving privileged binaries

Detection Strategies

• Monitoring system audit logs and process execution telemetry for SUID/SGID binary usage
• Behavioral detection focused on anomalous execution patterns and privilege escalations
• Correlation of file integrity monitoring alerts with process and user activity logs

Mitigation & Prevention

• Regular auditing and minimizing of SUID/SGID binaries on systems
• Implementing least privilege principles and restricting write permissions on privileged binaries
• Use of mandatory access controls (e.g., SELinux, AppArmor) to limit binary execution contexts
• Enforcing strong user and identity management policies to reduce unnecessary privilege assignments

Response Considerations

• Immediate isolation of affected systems to prevent further privilege escalation
• Investigation of modified or newly introduced SUID/SGID binaries and associated user activity
• Restoration of binaries from trusted sources and hardening of system configurations

Related Techniques

• Exploitation of vulnerable services or software for initial access
• Credential dumping and reuse to facilitate lateral movement
• Use of scheduled tasks or cron jobs for persistence

Mapping & References

• MITRE ATT&CK T1548 – Abuse Elevation Control Mechanism
• MITRE ATT&CK T1055 – Process Injection (related to privilege escalation)
• Public advisories on SUID/SGID binary vulnerabilities and privilege escalation techniques