Detection: Python Network Traffic During Package Build

Description

The following analytic detects a Python process making an outbound network connection during package installation. Adversaries can abuse setup.py build scripts by leveraging distutils/setuptools command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed. This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running pip install. If confirmed malicious, this could indicate a successful software supply chain compromise.

Search

 1`sysmon`
 2(
 3    EventID=1
 4    (
 5        process="*_in_process.py*"
 6        OR
 7        process_name=python.exe
 8    )
 9)
10OR
11(
12    EventID=3
13    dest_ip!=""
14    process_name=python.exe
15)
16
17
18| eval dest=if(EventID=3, Computer, dest)
19
20
21| stats count min(_time) as firstTime
22              max(_time) as lastTime
23              values(parent_process_id) as parent_process_id
24              values(parent_process_path) as parent_process_path
25              values(parent_process_name) as parent_process_name
26              values(parent_process) as parent_process
27              values(process_path) as process_path
28              values(process_name) as process_name
29              values(process) as process
30              values(dest_ip) as dest_ip
31              values(dest_host) as dest_host
32
33  by dest source process_id
34
35
36| search process="* build_wheel*" dest_ip=*
37
38
39| table firstTime lastTime
40        parent_process_id parent_process_path parent_process_name parent_process
41        process_id process_path process_name process
42        dest_ip dest_host
43        dest source
44
45
46| `security_content_ctime(firstTime)`
47
48| `security_content_ctime(lastTime)`
49
50| `python_network_traffic_during_package_build_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 3	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.

Known False Positives

Python packages may contact software repositories, mirror sites during build time. Investigate the destination and package content to determine legitimacy.

Associated Analytic Story

• Malicious Python Package Installation

• Compromised Windows Host

• Ingress Tool Transfer

• Command And Control

Intermediate Findings

Threat Objects

References

• https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1