Detection: Python Site Hooks Creation During Package Installation

Description

The following analytic detects the creation of a Python site hook file (sitecustomize.py or usercustomize.py) within a site-packages/dist-packages directory in conjunction with a package installation process. Python's site module loads these hooks from directories on sys.path before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint. The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.

Search

 1`sysmon`
 2EventID IN (1,11)
 3(
 4    process="* install *"
 5    OR
 6    (
 7        action="created"
 8        file_path="*-packages\\*"
 9        file_path IN ("*sitecustomize.py", "*usercustomize.py")
10    )
11)
12
13
14| stats count min(_time) as firstTime
15              max(_time) as lastTime
16              values(parent_process_id) as parent_process_id
17              values(parent_process_path) as parent_process_path
18              values(parent_process_name) as parent_process_name
19              values(parent_process) as parent_process
20              values(process_path) as process_path
21              values(process_name) as process_name
22              values(process) as process
23              values(file_path) as file_path
24              values(file_name) as file_name
25              dc(EventID) as dc_event_id
26              by dest source process_id
27
28
29| search dc_event_id>1
30
31
32| table firstTime lastTime
33        parent_process_id parent_process_path parent_process_name parent_process
34        process_id process_path process_name process
35        file_path file_name
36        dest source
37
38
39| `security_content_ctime(firstTime)`
40
41| `security_content_ctime(lastTime)`
42
43| `python_site_hooks_creation_during_package_installation_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the Splunk Common Information Model (CIM).

Known False Positives

Some legitimate tooling and environment managers create or modify sitecustomize.py/usercustomize.py as part of normal setup. Investigate the file contents and parent process to determine legitimacy.

Associated Analytic Story

• Malicious Python Package Installation

• Compromised Windows Host

• Windows Persistence Techniques

Finding

Threat Objects

References

• https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1