id: suid-sgid-files

info:
  name: macOS SUID/SGID Files Detection
  author: geeknik
  severity: high
  description: |
    Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
  impact: |
    Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
  remediation: |
    Review the list of SUID/SGID files and remove the permissions if they are not necessary.
  tags: macos,audit,local,security,privesc

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
    matchers:
      - type: regex
        regex:
          - "^-rws.*"
          - "^-..s.*"
# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950