Detectionhightest
Python Spawning Pretty TTY on Windows
Detects python spawning a pretty tty
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic3 selectors
detection:
selection_img:
Image|endswith:
- 'python.exe' # no \ bc of e.g. ipython.exe
- 'python3.exe'
- 'python2.exe'
selection_cli_1:
CommandLine|contains|all:
- 'import pty'
- '.spawn('
selection_cli_2:
CommandLine|contains: 'from pty import spawn'
condition: selection_img and 1 of selection_cli_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
480e7e51-e797-47e3-8d72-ebfce65b6d8d
Status
test
Level
high
Type
Detection
Created
Fri Jun 03
Author
Path
rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml
Raw Tags
attack.executionattack.t1059