Elastic medium stable kql

Suspicious UID Change to Root via Python

Detects a UID change event to 0 (root) where the responsible process is a Python interpreter running from a user- or world-writable working directory and the parent process is non-root. This may be indicative of a local privilege escalation exploit executed via Python. Using the new terms feature, noise from automated tools or system processes is partially filtered out.

View Source

Detection Logic

event.category:process and host.os.type:linux and event.type:change and event.action:uid_change and
user.id:0 and not process.parent.user.id:0 and not process.parent.group.id:0 and process.name:python* and
process.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.parent.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.command_line:*

False Positives

⚠ Some automation or break-glass tooling may invoke Python from scripts under /home or other temporary directories; validate parent identity and working directory before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...