Detection: Python PTH File Creation During Package Installation

Description

The following analytic detects the creation of a Python path configuration (.pth) file in conjunction with a package installation process. Path configuration files placed under site-packages or dist-packages are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type. This technique was used by the threat actor group TeamPCP during the supply chain compromise of the litellm package. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.

Search

 1`sysmon`
 2EventID IN (1,11)
 3process_name="python.exe"
 4(
 5    process="* install *"
 6    OR
 7    (
 8        file_name="*.pth"
 9        action="created"
10    )
11)
12
13| stats count min(_time) as firstTime
14              max(_time) as lastTime
15              values(parent_process_id) as parent_process_id
16              values(parent_process_path) as parent_process_path
17              values(parent_process_name) as parent_process_name
18              values(parent_process) as parent_process
19              values(process_path) as process_path
20              values(process_name) as process_name
21              values(process) as process
22              values(file_name) as file_name
23              values(file_path) as file_path
24              dc(EventID) as dc_event_id
25
26  by dest source process_id
27
28
29| search dc_event_id>1 AND process!="*-- setuptools*"
30
31
32| table firstTime lastTime
33        parent_process_id parent_process_path parent_process_name parent_process
34        process_id process_path process_name process
35        file_name file_path
36        dest source
37
38
39| `security_content_ctime(firstTime)`
40
41| `security_content_ctime(lastTime)`
42
43| `python_pth_file_creation_during_package_installation_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the Splunk Common Information Model (CIM).

Known False Positives

Legitimate packages, such as those managing namespace packages or editable installs, may create .pth files as part of normal installation. Investigate the file contents and parent process to determine legitimacy.

Associated Analytic Story

• Malicious Python Package Installation

• Compromised Windows Host

• Windows Persistence Techniques

Intermediate Findings

Threat Objects

References

• https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1