SUID / SGID
Definition
Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and privilege-escalation vector.
- Full form
- Set-User-ID / Set-Group-ID
- Effect
- Binary runs with owner's privileges, not the invoking user's
- Forensic relevance
- Persistence and privilege-escalation vector
- OS
- Linux/Unix
Common questions
How do investigators find SUID/SGID abuse during a Linux forensic examination?+
Examiners search the filesystem for files with the SUID or SGID permission bit set, then compare the list against known-good baselines for the distribution. An unexpected SUID binary in a user's home directory or a temp folder is a strong indicator of an attacker-planted privilege-escalation tool.
Why is a SUID binary risky even if the file itself is not malicious code?+
Any SUID binary that can be tricked into executing arbitrary commands, reading arbitrary files, or spawning a shell effectively hands the invoking user root-equivalent access. Attackers frequently set the SUID bit on a copy of a legitimate shell or interpreter specifically to create this shortcut.
Related terms
- Auditd
- The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Inode
- The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in...
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- Plaso / Log2timeline
- The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or...
- Wtmp / Utmp / Btmp
- Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with...