LoFP / some automation or break-glass tooling may invoke python from scripts under /home or other temporary directories; validate parent identity and working directory before escalating.

Techniques

• T1059
• T1068

Sample rules

Suspicious UID Change to Root via Python

• source: elastic
• technicques:
  • T1059
  • T1068

Description

Detects a UID change event to 0 (root) where the responsible process is a Python interpreter running from a user- or world-writable working directory and the parent process is non-root. This may be indicative of a local privilege escalation exploit executed via Python. Using the new terms feature, noise from automated tools or system processes is partially filtered out.

Detection logic

event.category:process and host.os.type:linux and event.type:change and event.action:uid_change and
user.id:0 and not process.parent.user.id:0 and not process.parent.group.id:0 and process.name:python* and
process.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.parent.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.command_line:*