Identifier / Programs / Linux and Unix
setcap
Set capabilities of specified file. tldr-pages
GTFOBins privilege-escalation 2 Sigma rules name it 2 ATT&CK techniques 1 documented command
How setcap is abused
privilege-escalation
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for setcap.
1 documented command
privilege-escalation with sudo, as SUID
This can be used to assign capabilities to executable files.
setcap cap_setuid+ep /path/to/commandTrips 1 Sigma rule: lowLinux Setuid Capability Set on a Binary via Setcap Utility by Luc Génaux
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for setcap. The identifier reads the line that runs setcap.
What detects it
Everyday use
Set capability cap_net_raw (to use RAW and PACKET sockets) for a given file
setcap 'cap_net_raw' path/to/fileIdentifySet multiple capabilities on a file (ep behind the capability means "effective permitted")
setcap 'cap_dac_read_search,cap_sys_tty_config+ep' path/to/fileIdentifyRemove all capabilities from a file
setcap -r path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.