Capabilities Discovery - Linux

SigmaHQ Detections@sigmaHQ

•updated Jan 24, 2026•0•0•0

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.