# Source: https://docs.datadoghq.com/security/default_rules/def-000-2m5.md

---
title: Recently written or modified suid file has been executed
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Recently written or modified suid file
  has been executed
---

# Recently written or modified suid file has been executed
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1548-abuse-elevation-control-mechanism](https://attack.mitre.org/techniques/T1548) 
## What happened{% #what-happened %}

The SUID file `{{ @file.path }}` was executed after being recently modified, potentially indicating privilege escalation.

## Goal{% #goal %}

Execute a recently modified Set Owner User ID (SUID) file.

## Strategy{% #strategy %}

This rule identifies whenever a SUID file is executed after it has recently been created or modified. This could be an indication that an attacker is leveraging a privilege escalation vulnerability to execute files as root.

## Triage and response{% #triage-and-response %}

1. Determine if the SUID file executed is expected on the system.
1. If this file is unexpected, attempt to contain the compromise (this may be achieved by terminating the workload, depending on the stage of attack), and look for indications of initial compromise. Follow your organization's internal processes for investigating and remediating compromised systems.
1. Determine the nature of the attack and network tools involved. Investigate security signals (if present) occurring around the time of the event to establish an attack path and signals from other tools. For example, if a DNS exfiltration attack is suspected, examine DNS traffic and servers if available.
1. Find and repair the root cause of the compromise.

*Requires Agent version 7.27 or greater*