Unlocking Power Safely: Privilege Escalation via Linux Process Capabilities

This report explains how Linux process capabilities can be misconfigured or abused to achieve privilege escalation, detailing risks such as unnecessary capability assignment, capability inheritance, vulnerable setuid/setgid binaries, kernel flaws, bounding set issues, and misuse of file attributes. It offers mitigation guidance rooted in least privilege, auditing, secure configuration, proper bounding set usage, patching, hardening (SELinux/AppArmor), integrity checks, and monitoring. The report also highlights Elastic Security 8.11+ prebuilt detection rules and telemetry (CapPrm and CapEff) to identify discovery and privilege-escalation behaviors involving capabilities.