Techniques
Sample rules
Python PYTHONPATH Modification During Package Installation
- source: splunk
- technicques:
Description
The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
Python looks up the sys.path variable, which is generated by combining user and site folders with .pth files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
Detection logic
`sysmon`
EventID IN (1,13)
(
parent_process="*\\site-packages\\pip\\*"
OR
(
registry_path="*PYTHONPATH"
action="modified"
)
)
| stats count min(_time) as firstTime
max(_time) as lastTime
values(parent_process_id) as parent_process_id
values(parent_process_name) as parent_process_name
values(parent_process_path) as parent_process_path
values(parent_process) as parent_process
values(process_path) as process_path
values(process_name) as process_name
values(process) as process
values(registry_path) as registry_path
values(registry_value_data) as registry_value_data
dc(EventID) as dc_event_id
by dest source process_id
| search dc_event_id>1
| table firstTime lastTime
parent_process_id parent_process_path parent_process_name parent_process
process_id process_path process_name process
registry_path registry_value_data
dest source
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `python_pythonpath_modification_during_package_installation_filter`