This Linux endpoint rule detects a suspicious local privilege-escalation attempt where a Python interpreter, launched from a user- or world-writable directory (such as /tmp, /var/tmp, /dev/shm, /home/*, /run/user*, /var/www*), changes its effective user ID to root (UID 0) while its parent process is non-root. The detection requires a process event for a Python executable (process.name: python*), with both the Python process and its parent working directories in writable locations, and an event action indicating a UID change (event.type: change, event.action: uid_change) with user.id: 0 and a non-root parent. Parent identity must not be root to help distinguish exploitation from legitimate admin activity. The rule leverages Elastic’s new_terms capability to filter noise by focusing on newly observed process.command_line patterns and host identifiers within a rolling history window (now-5d). It maps to MITRE ATT&CK techniques: Privilege Escalation (T1068) via Exploitation for Privilege Escalation and Execution (T1059) with Python subtechnique. This pattern is indicative of a Python-based privilege-escalation attempt executed from writable directories, and the rule is designed to surface such chains for rapid containment.