add: Linux setcap setuid

[EzLucky]

Summary of the Pull Request

Add two related Linux rules (process_creation and auditd variations) a Linux rule to detect the use of setcap utility to set the setuid capability (cap_setuid) on a binary file.
This technique can be used to backdoor binaries in order to regain root privileges if lost by the attacker.

Changelog

new: Linux Setuid Capability Set on a Binary via Setcap Utility update: Capabilities Discovery - Linux - remove unneeded windash

Example Log Event

type=EXECVE msg=audit([...]): argc=3 a0="setcap" a1="cap_setuid+ep" a2="/path/to/binary"

Comments

Command line

setcap binary command line can vary depending on flags/parameters used :

• setcap cap_setuid+ep /path/to/binary
• setcap -q cap_setuid+ep /path/to/binary
• setcap cap_setuid=ep /path/to/binary
• setcap -q cap_setuid=ep /path/to/binary
• setcap cap_setuid+ep /path/to/binary -whateveryouwant ➡️ cap_setuid is set even if the command returns a fatal error
• setcap cap_setuid+ep /path/to/binary -r ➡️cap_setuid is set even if the command returns a fatal error, so we can not filter out the '-r' flag (which means "remove capabilities")
• etc.

False positives

I found here that legitimate software installations/updates could trigger the rule.
But as I could not reproduce it yet (and the false positives may be AI generated), I didn't include it in the falsepositives key.

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

We do not need the auditd version of rules that are targeting process_creation

[EzLucky]

Level set to low as the rule is very generic. In a futur PR I will dev a more specific one related to backdoored command interpreter with a higher level

[EzLucky]

windash removed from "Capabilities Discovery - Linux" as discussed in #5773

[EzLucky]

@swachchhanda000 @phantinuss looking at setgid linux capabilities, it has almost the same impact as setuid. Would you prefer a second rule dedicated to setgid, so both rules can have their own destiny, or would you include setgid in this rule ?

[nasbench]

@swachchhanda000 @phantinuss looking at setgid linux capabilities, it has almost the same impact as setuid. Would you prefer a second rule dedicated to setgid, so both rules can have their own destiny, or would you include setgid in this rule ?

Put it in a separate rule

[EzLucky]

@swachchhanda000 @phantinuss looking at setgid linux capabilities, it has almost the same impact as setuid. Would you prefer a second rule dedicated to setgid, so both rules can have their own destiny, or would you include setgid in this rule ?

Put it in a separate rule

New rule related to 'setgid' added in this MR as it is almost the same as the one on 'setuid' : changed "uid" to "gid" and "user" to "group".