sequence by host.id, process.entity_id with maxspan=1s
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.args : "import os;os.set?id(0);os.system(*)" and process.args : "*python*" and user.id != "0"]
[process where host.os.type == "linux" and event.action in ("uid_change", "gid_change") and event.type == "change" and
(user.id == "0" or group.id == "0")]
Install detection rules in Elastic Security
Detect Potential Privilege Escalation via Python cap_setuid in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).