Detection: Python PYTHONPATH Modification During Package Installation

Description

The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process. Python looks up the sys.path variable, which is generated by combining user and site folders with .pth files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules. If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.

Search

 1`sysmon`
 2EventID IN (1,13)
 3(
 4    parent_process="*\\site-packages\\pip\\*"
 5    OR
 6    (
 7        registry_path="*PYTHONPATH"
 8        action="modified"
 9    )
10)
11
12
13| stats count min(_time) as firstTime
14              max(_time) as lastTime
15              values(parent_process_id) as parent_process_id
16              values(parent_process_name) as parent_process_name
17              values(parent_process_path) as parent_process_path
18              values(parent_process) as parent_process
19              values(process_path) as process_path
20              values(process_name) as process_name
21              values(process) as process
22              values(registry_path) as registry_path
23              values(registry_value_data) as registry_value_data
24              dc(EventID) as dc_event_id
25
26  by dest source process_id
27
28
29| search dc_event_id>1
30
31
32| table firstTime lastTime
33        parent_process_id parent_process_path parent_process_name parent_process
34        process_id process_path process_name process
35        registry_path registry_value_data
36        dest source
37
38
39| `security_content_ctime(firstTime)`
40
41| `security_content_ctime(lastTime)`
42
43| `python_pythonpath_modification_during_package_installation_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 13	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) and registry modification (EventID 13) events, ensuring that registry modification events are collected for the PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the Splunk Common Information Model (CIM).

Known False Positives

Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration. Investigate the new value and parent process to determine legitimacy.

Associated Analytic Story

• Malicious Python Package Installation

• Windows Registry Abuse

• Suspicious Windows Registry Activities

• Windows Persistence Techniques

• Compromised Windows Host

Finding

Threat Objects

References

• https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1