# What is session\_id\_change in event.action?

**URL:** <https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950>\
**Category:** Elastic Security\
**Created:** [September 3, 2024, 12:16pm UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950 "2024-09-03T12:16:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moros\_ntd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moros_ntd/32/137260_2.png) [@Moros\_ntd](https://discuss.elastic.co/u/Moros_ntd)\
**Post date:** [September 3, 2024, 12:16pm UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950/1 "2024-09-03T12:16:17Z")

</div>

I'm using the "Suspicious Network Connection Attempt by Root" rule in Elastic, but I don't really understand it. I don't know how to trigger this rule through an attack because I don't understand why it needs to catch the `session_id_change` event following a `connection_attempted`. I don't understand what the `session_id_change` event is and when it occurs. Could someone provide me with an example? Here is the rule:

```auto
sequence by process.entity_id with maxspan=1m
[network where event.type == "start" and event.action == "connection_attempted" and user.id == "0" and
    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")]
[process where event.action == "session_id_change" and user.id == "0" and
    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")]

```

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [September 3, 2024, 12:37pm UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950/2 "2024-09-03T12:37:28Z")

</div>

Referring to the [doc](https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-3-1-suspicious-network-connection-attempt-by-root.html), If you have not taken a look -

> Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.

For reproducing, there are some reference given. Let me know if that helps.

---

<div class="post-metadata">

**Author:** ![Moros\_ntd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moros_ntd/32/137260_2.png) [@Moros\_ntd](https://discuss.elastic.co/u/Moros_ntd)\
**Post date:** [September 3, 2024, 1:54pm UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950/3 "2024-09-03T13:54:43Z")

</div>

They don't help me much. As far as I know, the session ID is set up whenever you log in (via SSH or similar) or when you create a new terminal. If so, why would an attacker want to change the session ID after attempting to create a connection?

---

<div class="post-metadata">

**Author:** ![Ruben\_Groenewoud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruben_groenewoud/32/123982_2.png) [@Ruben\_Groenewoud](https://discuss.elastic.co/u/Ruben_Groenewoud)\
**Post date:** [September 4, 2024, 7:51am UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950/4 "2024-09-04T07:51:34Z")

</div>

Hello, this rule has been deprecated in july 2023. But related to the question of when this activity would occur; this may occur in situations where a root user catches a reverse shell connection. This is a network event followed by a UID change. This activity is also seen in the port knocking functionality of the open source rootkit dubbed "Reptile". But because the rule was noisy, it was deprecated some time ago.

I hope that helps.

Ruben

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2024, 7:51am UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950/5 "2024-10-02T07:51:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.