Suspicious UID Change to Root via Python

Last updated a month ago on 2026-08-03

Created a month ago on 2026-08-03

About

Detects a UID change event to 0 (root) where the responsible process is a Python interpreter running from a user- or world-writable working directory and the parent process is non-root. This may be indicative of a local privilege escalation exploit executed via Python. Using the new terms feature, noise from automated tools or system processes is partially filtered out.

Tags

Data Source: Elastic DefendDomain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Privilege EscalationTactic: ExecutionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Exploitation for Privilege Escalation (T1068)(external, opens in a new tab or window)

Execution (TA0002)(external, opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(external, opens in a new tab or window)

False Positive Examples

Some automation or break-glass tooling may invoke Python from scripts under /home or other temporary directories; validate parent identity and working directory before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-endpoint.events.process*
Related Integrations: endpoint(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.category:process and host.os.type:linux and event.type:change and event.action:uid_change and
user.id:0 and not process.parent.user.id:0 and not process.parent.group.id:0 and process.name:python* and
process.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.parent.working_directory:(/tmp* or /var/tmp* or /dev/shm* or /home/* or /run/user* or /var/run/user* or /var/www*) and
process.command_line:*

Install detection rules in Elastic Security

Detect Suspicious UID Change to Root via Python in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).