Cross-source coverage
T1059.006 / ATT&CK
Command and Scripting Interpreter: Python
95 rules · 94 families across 6 sources.
2 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
- Tactics
- Execution
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonEDR:huntingmacos:unifiedlogmacos:osquerymacos:syslogauditd:SYSCALLlinux:syslogesxi:vobdesxi:hostd
How MITRE says to detect it DET0063
Cross-Platform Behavioral Detection of Python Execution
Windows Analytic 0172
Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.
WinEventLog:SysmonEventCode=1EDR:huntingAdvanced Hunting: DeviceProcessEvents + DeviceNetworkEvents
macOS Analytic 0173
Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.
macos:unifiedloglog stream --predicate 'eventMessage contains "python"'macos:osqueryprocess_eventsmacos:syslogsystem.log
Linux Analytic 0174
Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).
auditd:SYSCALLexecvelinux:syslog/var/log/syslog
ESXi Analytic 0175
Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.
esxi:vobd/var/log/vobd.logesxi:hostd/var/log/hostd.log
elastic/detection-rules
42 rules| Detection | Severity | Format |
|---|---|---|
| Base64 Decoded Payload Piped to Interpreter | High | Elastic TOML |
| Decoded Payload Piped to Interpreter Detected via Defend for Containers | High | Elastic TOML |
| Google Calendar C2 via Script Interpreter | High | Elastic TOML |
| Interactive Terminal Spawned via Python | High | Elastic TOML |
| Long Base64 Encoded Command via Scripting Interpreter | High | Elastic TOML |
| Potential Etherhiding C2 via Blockchain Connection | High | Elastic TOML |
| Potential JAVA/JNDI Exploitation Attempt | High | Elastic TOML |
| Potential Privilege Escalation via Python cap_setuid | High | Elastic TOML |
| Potential Reverse Shell via Suspicious Child Process | High | Elastic TOML |
| Potential SAP NetWeaver Exploitation | High | Elastic TOML |
+ 32 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
33 rules · 32 families| Detection | Severity | Format |
|---|---|---|
| Arbitrary Python Code Execution via Nodejs | Undefined | Elastic TOML |
| Command Interpreter with IP Address Argument | Undefined | Elastic TOML |
| Empire Stager Execution | Undefined | Elastic TOML |
| Hidden Folder or File Access in Tmp via Python | Undefined | Elastic TOML |
| Initial Access or Execution via Microsoft Office Application | Undefined | Elastic TOML |
| Initial Access via OSA Shell Script Piped to Python Interpreter | Undefined | Elastic TOML |
| Linux Hidden Folder or File Execution via Python | Undefined | Elastic TOML |
| Long Base64 Command Execution via Interactive Shell | Undefined | Elastic TOML |
| Long Base64 Encoded Interpreter Command Line | Undefined | Elastic TOML |
| Payload Piped to Script Interpreter | Undefined | Elastic TOML |
+ 23 more from elastic/protections-artifacts → showing the 10 highest-severity
SigmaHQ/sigma
13 rules| Detection | Severity | Format |
|---|---|---|
| Axios NPM Compromise Indicators - Linux | High | Sigma |
| Emotet Loader Execution Via .LNK File | High | Sigma |
| Python One-Liners with Base64 Decoding | High | Sigma |
| Python One-Liners with Base64 Decoding - Linux | High | Sigma |
| Serpent Backdoor Payload Execution Via Scheduled Task | High | Sigma |
| TanStack Supply-Chain Attack Execution Indicators - Linux | High | Sigma |
| AppLocker Application Would Have Been Blocked | Medium | Sigma |
| AppLocker Prevented Application or Script from Running | Medium | Sigma |
| Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution | Medium | Sigma |
| Python Path Configuration File Creation - Linux | Medium | Sigma |
+ 3 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Python pty spawn used to escalate shell (T1059.006) | High | Wazuh XML |
| Python script downloading external payload (e.g., linpeas.sh) – T1059.006 | High | Wazuh XML |
| Suspicious inline Python execution with download or system call (T1059.006) | High | Wazuh XML |
| Execution of compiled Python bytecode file (.pyc) (T1059.006) | Medium | Wazuh XML |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious python script matches Impacket signature, possible use of stolen credentials or pass the hash attack. | High | Wazuh XML |
| Executed python script from /tmp/ folder. | Medium | Wazuh XML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Python Network Traffic During Package Build | Undefined | SPL |