Name:Python PTH File Creation During Package Installation id:bf581b86-39cd-48b7-9312-d9affb48a8bc version:1 date:None author:Onur Mustafa Erdogan, Splunk status:production type:Anomaly Description:The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host. Data_source:
-Sysmon EventID 1 AND Sysmon EventID 11
search:`sysmon` EventID IN (1,11) process_name="python.exe" ( process="* install *" OR ( file_name="*.pth" action="created" ) ) | stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_id) as parent_process_id values(parent_process_path) as parent_process_path values(parent_process_name) as parent_process_name values(parent_process) as parent_process values(process_path) as process_path values(process_name) as process_name values(process) as process values(file_name) as file_name values(file_path) as file_path dc(EventID) as dc_event_id
by dest source process_id
| search dc_event_id>1 AND process!="*-- setuptools*"
| table firstTime lastTime parent_process_id parent_process_path parent_process_name parent_process process_id process_path process_name process file_name file_path dest source
how_to_implement:This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth
extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
Splunk Common Information Model (CIM). known_false_positives:Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
Investigate the file contents and parent process to determine legitimacy. References: -https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Malicious Python Package Installation', 'Compromised Windows Host', 'Windows Persistence Techniques']
