Python Spawning Pretty TTY on Windows

Title: Python Spawning Pretty TTY on Windows
Status: test
Description:Detects python spawning a pretty tty
References:
  -https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Author: Nextron Systems
Date: 2022-06-03
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith:
      -'python.exe'
      -'python3.exe'
      -'python2.exe'

  selection_cli_1:
    CommandLine|contains|all:
      -'import pty'
      -'.spawn('

  selection_cli_2:
    CommandLine|contains: 'from pty import spawn'
  condition:selection_img and 1 of selection_cli_*
Falsepositives:
  -Unknown
Level: high