Shell Privileged Mode from Non-Standard Path with Root Effective User

[rule]
description = """
Detects a process execution with the privileged mode flag where the effective user is root but the real user name is not
root, and the executable is outside common system binary directories. This pattern is often used after exploiting a
setuid shell or similar to drop restrictions while keeping an elevated effective identity.
"""
id = "a2c8f4e1-7b3d-4c9a-8f2e-11d04e8c3a90"
license = "Elastic License v2"
name = "Shell Privileged Mode from Non-Standard Path with Root Effective User"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/#+suid"]
version = "1.0.2"

query = '''
process where event.action == "exec" and user.name == "root" and user.Ext.real.name != "root" and
  user.Ext.real.name != null and process.args == "-p" and
  process.executable != null and process.parent.executable != null and 
  process.executable like ("/var/tmp/*", "/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*") and 
  not (process.executable like "/tmp/newroot/usr/bin/*" and process.parent.executable like "/tmp/newroot/bin/*") and 
  not (process.executable like "/run/k3s/containerd/*" and process.parent.executable like "/run/k3s/containerd/*") and
  not process.executable in ("/tmp/newroot/usr/sbin/sudo", "/tmp/newroot/usr/bin/sudo")
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.6.0"