Suspicious Python Script Interpreter

Description

Identifies the execution of a recently dropped executable that loads python libraries to interact with Windows APIs.

Query · eql

sequence by process.entity_id with maxspan=1m
 [process where (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and 
  process.executable != null and 
  not process.code_signature.trusted == true and 
  not process.executable :
            ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
             "?:\\Python*\\python*.exe",
             "?:\\Users\\*\\AppData\\Local\\*.exe",
             "?:\\Users\\*\\Desktop\\*.exe",
             "?:\\*\\Anaconda?\\python*.exe",
             "D:\\AppsSvcs\\SeaAiSsoDocsService\\SeaAiSsoDocsService.exe",
             "D:\\AppsSvcs\\GenAIServiceCode\\GenAIServiceCode.exe",
             "D:\\AppsSvcs\\GenAIServiceDocs\\GenAIServiceDocs.exe",
             "D:\\AppsSvcs\\SsoAiServiceDocs\\SsoAiServiceDocs.exe",
             "?:\\Users\\*\\AppData\\Local\\Programs\\Python\\Python*\\python.exe", 
             "?:\\ProgramData\\checkmk\\agent\\modules\\python*\\.venv\\Scripts\\python.exe",
             "?:\\Users\\*\\AppData\\Local\\Packages\\PythonSoftwareFoundation.Python.*\\LocalCache\\local-packages\\*\\Scripts\\dist\\LiveLinkATC*.exe") and
  not process.hash.sha256 : 
                   ("b80be3102561bf891454bd52673fdcd49d08b14c17061c077d6a88ca5ba3e9e3", 
                    "8e7bbf6e1bc3588f6d13b8372ca1bef37b6758b8a3a17bda424eba140dd4e8fe",
                    "37c3aa7e782e7331d9831ce5df27d80ac8760657ba51beb75a60b93e2d2f138b",
                    "bf2cd24734e0aba2495fa8ca138c79df8d8d56309001a69a47abbe55a1872a15",
                    "5a20b73eae6179b4553c2a066afe1ca1d9873bb1005ce1e9459d7edb9c63a280",
                    "3cfb1833ddab2145a62a7b3df311dcf4315d14ddb88f6be1e04557943e920d22",
                    "a37e022b30fd8c91ade968373fa0ca714e915a207fe4e93ac5f86fdae289cf3a",
                    "c475438563d23dc91dd9bba960b11fa1b194409967648770390f68fed62c1e57",
                    "74991c716e16c5b2ed186096e24b1f739597c48d328a52b85576911aa36ce25c",
                    "0bea60c6a85b369eb237520af21fa47c33f4bcf42d83d3cb0a9c91cfaac89959",
                    "50e109260bbaafa95d107f4bb0a9e54ec3494735c54b6da3885f2f1079e36d5b",
                    "cacde2ae530296624adbca7393f84015f0d5cb0e1c1c5a4345b91e3a841dd5f9",
                    "14f1d41be0a0218233b1b823ddb9ed3ac06603c15c56c2f11aa4a286e72c2e4e",
                    "03b8dfcf64c4e9801becb8945cdf1ebc6f3524daf5de75f662204553e97a4f05",
                    "ca78c09f7c334844dba28d0d6438ac507d14ad2874c04635cae42d398df4b6fd",
                    "8f067758c753c4d325653f2349bf5f761c4e1b4fb8a4516a152afc2375a88800",
                    "9ad4c8d68a26f6feb2287e9d9895358a5a560ecc34cb3649edade01b054e1dd5",
                    "8f8eaad0cbf91258227c1ed118813d940de56b324d358a9261f1fa18727beac1",
                    "a487293c9b2439024db52441bfa2a6220117e461e8124659bd962dcd5eb9ca58",
                    "7e5506b2975365bc490e27bf141593ec6d1da8858311b7dc1872dce1681ed1e5",
                    "dc9d9b130c2271fb3d5ebce3f10b84682d7c420ccb72220f7942f40b9e833c82",
                    "273823283ed4d333a585462dba323186bbb436522182488936879aa3af35cfbb",
                    "39813ef813924c17f0b19aef66b7b80987670e39a3f6daae2ef0b5a0b62f71e0",
                    "c70fa68e604f91387bbe920971057cb04148c0fed4142124ccd9226abfb93538",
                    "afbe4150814176a86abb7192b14465b88a0cbf3a58b512eaa533fb56dccc6077",
                    "7351523031359477a5ac0e6d39b04dec624fd3e990f85e698b6f2a77873963fd",
                    "5ab87d9be556f9ba07686993399ddf36713e3ed453c0ccb36bb6b76c5946d044",
                    "a55091876a0682795353e398f1a5f974a2ee5e38ce0fcab79519b9d1ec464db9",
                    "bdd94e30ad1f48c3d537aabbe65353ec5b7c80a338c13afb280a4bb9a4d77c58",
                    "be4827351259b82b0e347cce4b15ff4b25a63a06c754c2621fbcf7134fc30342",
                    "a53af751d32103fab234be6ae680fc0f6057989d8ff1486d8d5b26ccde0b3d70",
                    "1a59794c7c29f4569a0fe87bc9d9ffbf57835358c69f957950cd9718151f1af6",
                    "3d8595f90fb478cb0f3673a4e5162ac054638fe699a3879ad47514cf872077dd",
                    "87c927fb0f347bcb689d115e6515b285302d2253cab727924924b85da9056a9e", 
                    "ff6b583cfc19ea28e9d3580af49e6db71675a5869e27de5f2940580948258b32", 
                    "31f692eaa4a205f52235f43ee69b23c6789b45ed11e5a831e9b9b460c3985867",
                    "3c2e7b09c5bd39f7c0dd7413d497825c4383fe02ad27410c2b7abf315f4fd91d",
                    "129502c5d1e7c5ce49941fda604e654e69235cf5fe856fbf2a610303e8de6e26",
                    "b0200d91dda15b6a76be5b57a247247fc5d6b5ba833b8b9f186d89745f1a82dd",
                    "6f463847cc8951b63ae47381e308b380a981ee93e6ccc5a279474a59f2fa0e30",
                    "51291914e0cf34090ed205738f1d98d8a73b3f394094bc7175876e1b1039ceb1",
                    "0149486bdaebe992502756f4c6fb5be6e9fa927598355e33283f517620479fb4",
                    "f2dda7c8cf878054bdff6943a479fe3e7d41ba74079089670e8e0a2bf680220c",
                    "3dff263228c025f393b9ec418dc4b0d4796d51d2775500061e566f7fb40a9857",
                    "eca5e5510e95804fd6af240d4247806e022214b14a7e2d68b825363b846b35f0",
                    "3489700e2aaee32c4806cf9ad590352db4f35bffeca4a7ec510beaf81069d877",
                    "60104130ddba5a1c0af212e88c044adedf672aa59d69c5ead20581f79d069346",
                    "a03e3bcdff4f47bd18b17733c764bfbbddaa247ce6f850c5bf48a5e5e6308da7",
                    "1bedd9c0ceb91dd745808293591a4896e3be67066dbe267fe6d664733965fe15",
                    "a3e7ae2761115925e5b367de1684a15f880eba028686d40bcd7d377641b311ee",
                    "b0ecc848b56af95a7d945e2a97d8466dc8c387468bbb3264c334dd996a953517",
                    "b0dd44c64e360ca412640fbbd8744483901db12c659ee28b3e752b040e2cba62")
  ]
 [library where dll.name : ("win32api*.pyd", "win32process.pyd", "win32security.pyd", "md.cp*-win32.pyd", "win32crypt.pyd", "win32net.pyd")]
 [network where
   event.action : ("disconnect_received", "connection_attempted") and
   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
Raw source Suspicious Python Script Interpreter · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = "Identifies the execution of a recently dropped executable that loads python libraries to interact with Windows APIs."
id = "20eaa6a3-6b80-48bc-9c48-a935138169f9"
license = "Elastic License v2"
name = "Suspicious Python Script Interpreter"
os_list = ["windows"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and 
  process.executable != null and 
  not process.code_signature.trusted == true and 
  not process.executable :
            ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
             "?:\\Python*\\python*.exe",
             "?:\\Users\\*\\AppData\\Local\\*.exe",
             "?:\\Users\\*\\Desktop\\*.exe",
             "?:\\*\\Anaconda?\\python*.exe",
             "D:\\AppsSvcs\\SeaAiSsoDocsService\\SeaAiSsoDocsService.exe",
             "D:\\AppsSvcs\\GenAIServiceCode\\GenAIServiceCode.exe",
             "D:\\AppsSvcs\\GenAIServiceDocs\\GenAIServiceDocs.exe",
             "D:\\AppsSvcs\\SsoAiServiceDocs\\SsoAiServiceDocs.exe",
             "?:\\Users\\*\\AppData\\Local\\Programs\\Python\\Python*\\python.exe", 
             "?:\\ProgramData\\checkmk\\agent\\modules\\python*\\.venv\\Scripts\\python.exe",
             "?:\\Users\\*\\AppData\\Local\\Packages\\PythonSoftwareFoundation.Python.*\\LocalCache\\local-packages\\*\\Scripts\\dist\\LiveLinkATC*.exe") and
  not process.hash.sha256 : 
                   ("b80be3102561bf891454bd52673fdcd49d08b14c17061c077d6a88ca5ba3e9e3", 
                    "8e7bbf6e1bc3588f6d13b8372ca1bef37b6758b8a3a17bda424eba140dd4e8fe",
                    "37c3aa7e782e7331d9831ce5df27d80ac8760657ba51beb75a60b93e2d2f138b",
                    "bf2cd24734e0aba2495fa8ca138c79df8d8d56309001a69a47abbe55a1872a15",
                    "5a20b73eae6179b4553c2a066afe1ca1d9873bb1005ce1e9459d7edb9c63a280",
                    "3cfb1833ddab2145a62a7b3df311dcf4315d14ddb88f6be1e04557943e920d22",
                    "a37e022b30fd8c91ade968373fa0ca714e915a207fe4e93ac5f86fdae289cf3a",
                    "c475438563d23dc91dd9bba960b11fa1b194409967648770390f68fed62c1e57",
                    "74991c716e16c5b2ed186096e24b1f739597c48d328a52b85576911aa36ce25c",
                    "0bea60c6a85b369eb237520af21fa47c33f4bcf42d83d3cb0a9c91cfaac89959",
                    "50e109260bbaafa95d107f4bb0a9e54ec3494735c54b6da3885f2f1079e36d5b",
                    "cacde2ae530296624adbca7393f84015f0d5cb0e1c1c5a4345b91e3a841dd5f9",
                    "14f1d41be0a0218233b1b823ddb9ed3ac06603c15c56c2f11aa4a286e72c2e4e",
                    "03b8dfcf64c4e9801becb8945cdf1ebc6f3524daf5de75f662204553e97a4f05",
                    "ca78c09f7c334844dba28d0d6438ac507d14ad2874c04635cae42d398df4b6fd",
                    "8f067758c753c4d325653f2349bf5f761c4e1b4fb8a4516a152afc2375a88800",
                    "9ad4c8d68a26f6feb2287e9d9895358a5a560ecc34cb3649edade01b054e1dd5",
                    "8f8eaad0cbf91258227c1ed118813d940de56b324d358a9261f1fa18727beac1",
                    "a487293c9b2439024db52441bfa2a6220117e461e8124659bd962dcd5eb9ca58",
                    "7e5506b2975365bc490e27bf141593ec6d1da8858311b7dc1872dce1681ed1e5",
                    "dc9d9b130c2271fb3d5ebce3f10b84682d7c420ccb72220f7942f40b9e833c82",
                    "273823283ed4d333a585462dba323186bbb436522182488936879aa3af35cfbb",
                    "39813ef813924c17f0b19aef66b7b80987670e39a3f6daae2ef0b5a0b62f71e0",
                    "c70fa68e604f91387bbe920971057cb04148c0fed4142124ccd9226abfb93538",
                    "afbe4150814176a86abb7192b14465b88a0cbf3a58b512eaa533fb56dccc6077",
                    "7351523031359477a5ac0e6d39b04dec624fd3e990f85e698b6f2a77873963fd",
                    "5ab87d9be556f9ba07686993399ddf36713e3ed453c0ccb36bb6b76c5946d044",
                    "a55091876a0682795353e398f1a5f974a2ee5e38ce0fcab79519b9d1ec464db9",
                    "bdd94e30ad1f48c3d537aabbe65353ec5b7c80a338c13afb280a4bb9a4d77c58",
                    "be4827351259b82b0e347cce4b15ff4b25a63a06c754c2621fbcf7134fc30342",
                    "a53af751d32103fab234be6ae680fc0f6057989d8ff1486d8d5b26ccde0b3d70",
                    "1a59794c7c29f4569a0fe87bc9d9ffbf57835358c69f957950cd9718151f1af6",
                    "3d8595f90fb478cb0f3673a4e5162ac054638fe699a3879ad47514cf872077dd",
                    "87c927fb0f347bcb689d115e6515b285302d2253cab727924924b85da9056a9e", 
                    "ff6b583cfc19ea28e9d3580af49e6db71675a5869e27de5f2940580948258b32", 
                    "31f692eaa4a205f52235f43ee69b23c6789b45ed11e5a831e9b9b460c3985867",
                    "3c2e7b09c5bd39f7c0dd7413d497825c4383fe02ad27410c2b7abf315f4fd91d",
                    "129502c5d1e7c5ce49941fda604e654e69235cf5fe856fbf2a610303e8de6e26",
                    "b0200d91dda15b6a76be5b57a247247fc5d6b5ba833b8b9f186d89745f1a82dd",
                    "6f463847cc8951b63ae47381e308b380a981ee93e6ccc5a279474a59f2fa0e30",
                    "51291914e0cf34090ed205738f1d98d8a73b3f394094bc7175876e1b1039ceb1",
                    "0149486bdaebe992502756f4c6fb5be6e9fa927598355e33283f517620479fb4",
                    "f2dda7c8cf878054bdff6943a479fe3e7d41ba74079089670e8e0a2bf680220c",
                    "3dff263228c025f393b9ec418dc4b0d4796d51d2775500061e566f7fb40a9857",
                    "eca5e5510e95804fd6af240d4247806e022214b14a7e2d68b825363b846b35f0",
                    "3489700e2aaee32c4806cf9ad590352db4f35bffeca4a7ec510beaf81069d877",
                    "60104130ddba5a1c0af212e88c044adedf672aa59d69c5ead20581f79d069346",
                    "a03e3bcdff4f47bd18b17733c764bfbbddaa247ce6f850c5bf48a5e5e6308da7",
                    "1bedd9c0ceb91dd745808293591a4896e3be67066dbe267fe6d664733965fe15",
                    "a3e7ae2761115925e5b367de1684a15f880eba028686d40bcd7d377641b311ee",
                    "b0ecc848b56af95a7d945e2a97d8466dc8c387468bbb3264c334dd996a953517",
                    "b0dd44c64e360ca412640fbbd8744483901db12c659ee28b3e752b040e2cba62")
  ]
 [library where dll.name : ("win32api*.pyd", "win32process.pyd", "win32security.pyd", "md.cp*-win32.pyd", "win32crypt.pyd", "win32net.pyd")]
 [network where
   event.action : ("disconnect_received", "connection_attempted") and
   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.