macOS Setuid/Setgid Privilege Escalation

title: macOS Setuid/Setgid Privilege Escalation
id: 0f3109b3-d7e5-4c8a-a082-d8f0fa7be7a1
status: experimental
description: 'Detects setuid or setgid operations that transition to root (UID 0) from
  non-root users, which may indicate privilege escalation attempts.

  These syscalls allow processes to change their effective user ID or group ID, often

  used by attackers to gain elevated privileges. High-fidelity detection focuses on

  transitions to root from non-privileged users.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1548/001/
- https://attack.mitre.org/techniques/T1068/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_setuid:
    esf.event_type: 24
    event.action: setuid
  selection_setgid:
    esf.event_type: 25
    event.action: setgid
  selection_to_root:
    TargetUserId: 0
  selection_root_source:
    UserId: 0
  condition: (selection_setuid or selection_setgid) and selection_to_root and not selection_root_source
falsepositives:
- Legitimate system utilities and services
- Software installation and updates
- Authorized administrative tools
fields:
- event_type
- event_name
- ProcessId
- User
- UserId
- TargetUser
- TargetUserId
tags:
- attack.privilege_escalation
- attack.t1548.001
- attack.t1068
level: high