Threat Huntmediumtest

Python Path Configuration File Creation - MacOS

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Andreas Braathen (mnemonic.io)Created Thu Apr 254f394635-13ef-4599-b677-3353e0f84f55macos
Hunting Hypothesis
Log Source
macOSFile Event
ProductmacOS← raw: macos
CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetFilename|re: '(?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/' # Unix and macOS
        TargetFilename|endswith: '.pth'
    condition: selection
False Positives

Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.

MITRE ATT&CK

Sub-techniques

Other

detection.threat-hunting
Rule Metadata
Rule ID
4f394635-13ef-4599-b677-3353e0f84f55
Status
test
Level
medium
Type
Threat Hunt
Created
Thu Apr 25
Path
rules-threat-hunting/macos/file/file_event/file_event_macos_python_path_configuration_files.yml
Raw Tags
attack.executionattack.t1059.006detection.threat-hunting
View on GitHub