General Privilege Escalation Sequence Detected

[rule]
description = """
This rule detects the execution of a binary, followed by a UID change event to 0 (root), and then the execution of a
command that is used to check the current user's privileges. This sequence is often used by exploits to escalate
privileges to root, and check if the escalation was successful.
"""
id = "d8194360-9d84-43fb-bd8a-51db153d6632"
license = "Elastic License v2"
name = "General Privilege Escalation Sequence Detected"
os_list = ["linux"]
version = "1.0.6"

query = '''
sequence with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and user.id != 0 and
   process.executable like ("/tmp/*", "/dev/shm/*", "/var/tmp/*", "/home/*", "/run/user/*", "/var/run/user/*") and
   not process.parent.executable in ("/usr/bin/sw-engine", "/usr/sbin/sshd", "/usr/sbin/sw-engine-fpm", "/usr/lib/systemd/systemd")] by process.entity_id
  [process where event.type == "change" and event.action == "uid_change" and user.id == 0] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.name in ("whoami", "id", "logname") and user.id == 0] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"