Potential Privilege Escalation via Python Exploit

[rule]
description = """
Detects a UID change event to 0 (root) where the responsible process is a Python interpreter running from a user- or
world-writeable working directory and the parent process is non-root. This may be indicative of a local privilege
escalation exploit executed via Python.
"""
id = "c07d8af8-b688-4299-a3f7-2622a16913bf"
license = "Elastic License v2"
name = "Potential Privilege Escalation via Python Exploit"
os_list = ["linux"]
reference = [
    "https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/",
    "https://github.com/mooder1/dirtyclone-CVE-2026-43503",
]
version = "1.0.2"

query = '''
process where event.type == "change" and event.action == "uid_change" and
user.id == 0 and process.parent.user.id != 0 and process.parent.group.id != 0 and
process.name like "python*" and process.args like "*.py" and
process.working_directory like ("/tmp*", "/dev/shm*", "/var/tmp*", "/home/*", "/run/user*", "/var/run/user*") and
process.parent.working_directory like ("/tmp*", "/dev/shm*", "/var/tmp*", "/home/*", "/run/user*", "/var/run/user*") and
not (
  process.interactive == false or
  process.args like ("/usr/lib/linuxmint/mintUpdate/mintUpdate.py", "/home/*/.ansible/tmp/ansible-tmp-*.py") or
  process.executable like (
   "/sw/eb/sw/Python/*-GCCcore-*/bin/python*", "/home/*/*/anaconda3/envs/*/bin/python*", "/scratch/*/python*",
   "/home/*/.local/share/uv/python/cpython-*-linux-x86_64-gnu/bin/python*"
  ) or
  (
    process.working_directory like "/home/*/openmc/atr-model" and
    process.parent.executable like "/scratch/*/.conda/envs/openmc-env/bin/python*" and
    process.command_line == "python core_model.py"
  ) or
  process.parent.args like ("/home/agent/Claude/Project/Patches/venv/bin/python3*", "/usr/share/cinnamon/cinnamon-settings/cinnamon-settings.py")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.2.0"