Techniques
Sample rules
Python Network Traffic During Package Build
- source: splunk
- technicques:
Description
The following analytic detects a Python process making an outbound network connection during package installation.
Adversaries can abuse setup.py build scripts by leveraging distutils/setuptools command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running pip install.
If confirmed malicious, this could indicate a successful software supply chain compromise.
Detection logic
`sysmon`
(
EventID=1
(
process="*_in_process.py*"
OR
process_name=python.exe
)
)
OR
(
EventID=3
dest_ip!=""
process_name=python.exe
)
| eval dest=if(EventID=3, Computer, dest)
| stats count min(_time) as firstTime
max(_time) as lastTime
values(parent_process_id) as parent_process_id
values(parent_process_path) as parent_process_path
values(parent_process_name) as parent_process_name
values(parent_process) as parent_process
values(process_path) as process_path
values(process_name) as process_name
values(process) as process
values(dest_ip) as dest_ip
values(dest_host) as dest_host
by dest source process_id
| search process="* build_wheel*"
| table firstTime lastTime
parent_process_id parent_process_path parent_process_name parent_process
process_id process_path process_name process
dest_ip dest_host
dest source
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `python_network_traffic_during_package_build_filter`