Python Spawning Pretty TTY Via PTY Module

Title: Python Spawning Pretty TTY Via PTY Module
Status: test
Description:Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
References:
  -https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Author: Nextron Systems
Date: 2022-06-03
modified:2024-11-04
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection_img:
    - Image|endswith:
      - '/python'
      - '/python2'
      - '/python3'
    - Image|contains:
      - '/python2.'
      - '/python3.'
  selection_cli_import:
    CommandLine|contains:
      -'import pty'
      -'from pty '

  selection_cli_spawn:
    CommandLine|contains: 'spawn'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium