CmdID

CmdID / Commands

getcap

Display the name and capabilities of each specified file. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

Get capabilities for the given files

getcap path/to/file1 path/to/file2 ...Identify

Get capabilities for all the files recursively under the given directories

getcap -r path/to/directory1 path/to/directory2 ...Identify

Trips 1 Sigma rule: lowCapabilities Discovery - Linux by Nasreddine Bencherchali (Nextron Systems)

Display all searched entries even if no capabilities are set

getcap -v path/to/file1 path/to/file2 ...Identify

What detects it

Sigma process creation rules that name getcap
lowCapabilities Discovery - LinuxNasreddine Bencherchali (Nextron Systems)