python-based-attacks-on-macos

Description

This query was originally published in the threat analytics report, Python abuse on macOS The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows. The following query checks for Microsoft Office documents that run Python scripts. Reference - https://www.powershellempire.com/

Query · kql

DeviceProcessEvents
| where InitiatingProcessParentFileName in ("Microsoft Word", "Microsoft Excel")
| where FileName =~ "Python"
| where ProcessCommandLine matches regex "[A-Za-z0-9]{50}"
Raw source python-based-attacks-on-macos · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5a227ae6-1f40-499a-a4cc-6f6a0cc4d286
name: python-based-attacks-on-macos
description: |
  This query was originally published in the threat analytics report, Python abuse on macOS
  The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
  The following query checks for Microsoft Office documents that run Python scripts.
  Reference - https://www.powershellempire.com/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where InitiatingProcessParentFileName in ("Microsoft Word", "Microsoft Excel")
  | where FileName =~ "Python"
  | where ProcessCommandLine matches regex "[A-Za-z0-9]{50}"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.