Suspicious UID Change to Root via Python

  1[metadata]
  2creation_date = "2026/08/03"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a UID change event to 0 (root) where the responsible process is a Python interpreter
 11running from a user- or world-writable working directory and the parent process is non-root.
 12This may be indicative of a local privilege escalation exploit executed via Python. Using
 13the new terms feature, noise from automated tools or system processes is partially filtered out.
 14"""
 15false_positives = [
 16    """
 17    Some automation or break-glass tooling may invoke Python from scripts under /home or other temporary directories;
 18    validate parent identity and working directory before escalating.
 19    """,
 20]
 21from = "now-6m"
 22index = ["logs-endpoint.events.process*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "Suspicious UID Change to Root via Python"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating Suspicious UID Change to Root via Python
 32
 33This rule flags a Linux process where a Python interpreter launched from a user- or world-writable location suddenly switches to UID 0 even though its parent was not running as root, a strong sign of local privilege escalation. An attacker might drop or compile an exploit in /tmp or a home directory, execute it through python3, and use the resulting root context to take full control of the host.
 34
 35### Possible investigation steps
 36
 37- Reconstruct the full process ancestry and command line around the Python execution, including any shell, script, package manager, or developer tooling that launched it, to quickly separate expected admin activity from an unexpected exploit chain.
 38- Review the Python code and surrounding file activity in writable directories for exploit indicators such as dropped ELF binaries, compiled modules, kernel-targeting source, symlink abuse, or references to known privilege-escalation PoCs.
 39- Correlate the event with session context by identifying the associated user login, TTY, SSH source, sudo or su history, and recent commands to determine whether the root transition was intentional or adversary-driven.
 40- Examine actions performed immediately after the privilege change for signs of follow-on compromise, such as spawning an interactive root shell, modifying sudoers or PAM, creating cron or systemd persistence, adding users or SSH keys, or disabling security tooling.
 41- Validate whether the host was susceptible to a local privilege-escalation path at the time by checking kernel and OS version, recent patch status, and whether the observed artifacts match public exploits relevant to that platform.
 42
 43### False positive analysis
 44
 45- A developer or administrator may be legitimately testing a custom privileged Python helper from `/tmp` or a home directory that uses an approved setuid-root wrapper or retained capabilities to switch to UID 0, so verify the script and interpreter ownership, permissions/capabilities, and whether the activity matches a documented maintenance or test window.
 46- A local installation, upgrade, or recovery workflow can stage Python code in `/var/tmp`, `/dev/shm`, or `/home` and briefly elevate to root to complete expected file or permission changes, so confirm the parent process lineage, review the script contents and resulting system modifications, and ensure they align with recent authorized admin activity.
 47
 48### Response and remediation
 49
 50- Isolate the affected Linux host from the network except for approved response channels, suspend the compromised user session, and preserve the malicious Python script, its parent shell history, and any binaries dropped in `/tmp`, `/var/tmp`, `/dev/shm`, or the user home directory for forensic review.
 51- Kill the attacker-controlled Python process and any spawned root shell or child processes, then remove persistence such as new cron entries, rogue systemd services or timers, modified `/etc/rc.local`, added `authorized_keys`, backdoored `sudoers`, and unauthorized local accounts.
 52- Quarantine or delete exploit files and any trojaned binaries they replaced, rotate passwords and any SSH keys, API tokens, or service credentials exposed on the host, and review lateral access from that system while it was running with root privileges.
 53- Rebuild or restore the host from a known-good image if root-level changes cannot be fully scoped, then validate the kernel, installed packages, PAM configuration, `/etc/sudoers`, critical system binaries, and endpoint security tooling against a trusted baseline before reconnecting it.
 54- Escalate to incident response immediately if you find PAM or `sudoers` tampering, kernel module loading, additional root-capable accounts, signs of data staging or exfiltration, or the same Python-based privilege escalation pattern on more than one host.
 55- Harden the environment by patching the kernel and vulnerable packages, mounting `/tmp` and `/dev/shm` with `noexec`, `nodev`, and `nosuid` where feasible, removing unnecessary setuid bits and file capabilities, and alerting on interpreters elevating to root from user-writable directories.
 56"""
 57references = [
 58    "https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/",
 59    "https://github.com/mooder1/dirtyclone-CVE-2026-43503"
 60]
 61risk_score = 47
 62rule_id = "792411c3-361a-4ad6-8a38-7f7f6322ada1"
 63severity = "medium"
 64tags = [
 65    "Data Source: Elastic Defend",
 66    "Domain: Endpoint",
 67    "OS: Linux",
 68    "Use Case: Threat Detection",
 69    "Tactic: Privilege Escalation",
 70    "Tactic: Execution",
 71    "Resources: Investigation Guide",
 72]
 73timestamp_override = "event.ingested"
 74type = "new_terms"
 75query = '''
 76event.category:process and host.os.type:linux and event.type:change and event.action:uid_change and
 77user.id:0 and not process.parent.user.id:0 and not process.parent.group.id:0 and process.name:python* and
 78process.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
 79process.parent.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
 80process.command_line:*
 81'''
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85
 86  [rule.threat.tactic]
 87  name = "Privilege Escalation"
 88  id = "TA0004"
 89  reference = "https://attack.mitre.org/tactics/TA0004/"
 90
 91    [[rule.threat.technique]]
 92    id = "T1068"
 93    name = "Exploitation for Privilege Escalation"
 94    reference = "https://attack.mitre.org/techniques/T1068/"
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98
 99  [rule.threat.tactic]
100  name = "Execution"
101  id = "TA0002"
102  reference = "https://attack.mitre.org/tactics/TA0002/"
103
104    [[rule.threat.technique]]
105    id = "T1059"
106    name = "Command and Scripting Interpreter"
107    reference = "https://attack.mitre.org/techniques/T1059/"
108
109      [[rule.threat.technique.subtechnique]]
110      name = "Python"
111      id = "T1059.006"
112      reference = "https://attack.mitre.org/techniques/T1059/006/"
113
114[rule.new_terms]
115field = "new_terms_fields"
116value = ["process.command_line", "host.id"]
117
118[[rule.new_terms.history_window_start]]
119field = "history_window_start"
120value = "now-5d"