Techniques
Sample rules
Python PTH File Creation During Package Installation
- source: splunk
- technicques:
Description
The following analytic detects the creation of a Python path configuration (.pth) file in conjunction with a package installation process.
Path configuration files placed under site-packages or dist-packages are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the litellm package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Detection logic
`sysmon`
EventID IN (1,11)
process_name="python.exe"
(
process="* install *"
OR
(
file_name="*.pth"
action="created"
)
)
| stats count min(_time) as firstTime
max(_time) as lastTime
values(parent_process_id) as parent_process_id
values(parent_process_path) as parent_process_path
values(parent_process_name) as parent_process_name
values(parent_process) as parent_process
values(process_path) as process_path
values(process_name) as process_name
values(process) as process
values(file_name) as file_name
values(file_path) as file_path
dc(EventID) as dc_event_id
by dest source process_id
| search dc_event_id>1 AND process!="*-- setuptools*"
| table firstTime lastTime
parent_process_id parent_process_path parent_process_name parent_process
process_id process_path process_name process
file_name file_path
dest source
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `python_pth_file_creation_during_package_installation_filter`