Name:Python PYTHONPATH Modification During Package Installation id:00f01ba4-df01-4caa-90f6-187e4563a516 version:1 date:None author:Onur Mustafa Erdogan, Splunk status:production type:TTP Description:The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user. Data_source:
-Sysmon EventID 1 AND Sysmon EventID 13
search:`sysmon` EventID IN (1,13) ( parent_process="*\\site-packages\\pip\\*" OR ( registry_path="*PYTHONPATH" action="modified" ) )
| stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_id) as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) as parent_process_path values(parent_process) as parent_process values(process_path) as process_path values(process_name) as process_name values(process) as process values(registry_path) as registry_path values(registry_value_data) as registry_value_data dc(EventID) as dc_event_id
by dest source process_id
| search dc_event_id>1
| table firstTime lastTime parent_process_id parent_process_path parent_process_name parent_process process_id process_path process_name process registry_path registry_value_data dest source
how_to_implement:This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
and registry modification (EventID 13) events, ensuring that registry modification events are collected for the
PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on
and normalize field names using the Splunk Common Information Model (CIM). known_false_positives:Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
Investigate the new value and parent process to determine legitimacy. References: -https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Malicious Python Package Installation', 'Compromised Windows Host', 'Windows Persistence Techniques', 'Suspicious Windows Registry Activities', 'Windows Registry Abuse']
