Analytics Story: Malicious Python Package Installation

Updated Date: 2026-08-21 ID: 12e51c50-6b66-4ce7-83b8-95125ffd31e9 Author: Onur Mustafa Erdogan, Splunk Product: Splunk Enterprise Security

Description

This analytic story provides detection coverage for abuse of the Python package installation lifecycle, including install-time code execution, persistence via .pth path configuration files, Python site hooks, and PYTHONPATH environment variable manipulation.

Why it matters

Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure. Malicious packages and supply-chain attacks exploit the trust built into Python's packaging ecosystem to execute payloads at the moment of installation, without any direct interaction from the victim. Adversaries abuse several native Python features to achieve this. setup.py build scripts can leverage distutils/setuptools command classes to execute arbitrary code, including network beacons, during package installation. Path configuration files (.pth) placed in site-packages/dist-packages are executed on every subsequent Python invocation, providing persistence; this technique was used by the threat actor group TeamPCP during the supply-chain compromise of the litellm package. Python's site module also loads sitecustomize.py and usercustomize.py hook files from directories on sys.path, which adversaries can plant or manipulate to hijack the Python environment and achieve persistence, as seen with the VIPERTUNNEL backdoor. Finally, adversaries who can modify a user's PYTHONPATH environment variable can redirect module imports to attacker-controlled directories,achieving user-level persistence across new shell sessions. This story detects these behaviors by correlating process creation, file creation, and registry modification telemetry around Python package installation activity.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Python PTH File Creation During Package Installation	Compromise Software Supply Chain, Event Triggered Execution	Anomaly
Python Site Hooks Creation During Package Installation	Compromise Software Supply Chain, Event Triggered Execution	TTP
Python PYTHONPATH Modification During Package Installation	Compromise Software Supply Chain, Path Interception by PATH Environment Variable	TTP
Python Network Traffic During Package Build	Python, Compromise Software Supply Chain	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/

Source: GitHub | Version: 1