{"id":"T1059.006","name":"Python","url":"https://attack.mitre.org/techniques/T1059/006","tactics":["execution"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0063","stix_id":"x-mitre-detection-strategy--195e8d37-dfe6-4dc8-8012-dc80984872aa","name":"Cross-Platform Behavioral Detection of Python Execution","url":"https://attack.mitre.org/detectionstrategies/DET0063","analytics":[{"id":"AN0172","stix_id":"x-mitre-analytic--f392a2cb-dd4b-4585-84d5-1fa4bd65ff60","name":"Analytic 0172","description":"Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.","url":"https://attack.mitre.org/detectionstrategies/DET0063#AN0172","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"EDR:hunting","channel":"Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"edr-hunting"}],"mutable_elements":[{"field":"ParentProcess","description":"Non-standard processes spawning python.exe (e.g., winword.exe, mshta.exe)."},{"field":"ScriptPath","description":"Execution of .py from temp directories or user profile paths."},{"field":"TimeWindow","description":"Execution outside maintenance or patch windows."},{"field":"UserContext","description":"Execution by low-privileged or service accounts."},{"field":"ChildProcess","description":"Python spawning suspicious binaries or scripts (e.g., PowerShell, certutil)."}],"live":true,"detection_strategies":["DET0063"],"techniques":["T1059.006"]},{"id":"AN0173","stix_id":"x-mitre-analytic--bcac4672-778d-4b35-8b75-eaaf84b91853","name":"Analytic 0173","description":"Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.","url":"https://attack.mitre.org/detectionstrategies/DET0063#AN0173","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate 'eventMessage contains \"python\"'","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:syslog","channel":"system.log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-syslog"}],"mutable_elements":[{"field":"ExecutionPath","description":"Detects python scripts from ~/Downloads/, /Volumes/, or /tmp/."},{"field":"ScriptName","description":"Obfuscated or high entropy script names."},{"field":"SpawnChain","description":"Chained behavior: Python → bash → curl or Python → osascript."}],"live":true,"detection_strategies":["DET0063"],"techniques":["T1059.006"]},{"id":"AN0174","stix_id":"x-mitre-analytic--59354e08-ed82-4b95-99c5-aed3996473e1","name":"Analytic 0174","description":"Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).","url":"https://attack.mitre.org/detectionstrategies/DET0063#AN0174","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"/var/log/syslog","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ScriptDir","description":"Script invoked from /tmp, /var/tmp, or .hidden/ folders."},{"field":"ScheduledContext","description":"Execution from user cron or systemd timers outside of approved scripts."},{"field":"NetworkActivity","description":"Python performing HTTP/HTTPS without package updates."}],"live":true,"detection_strategies":["DET0063"],"techniques":["T1059.006"]},{"id":"AN0175","stix_id":"x-mitre-analytic--aff39b79-72c6-4cf9-8ddf-1332252580d5","name":"Analytic 0175","description":"Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0063#AN0175","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vobd","channel":"/var/log/vobd.log","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-vobd"},{"name":"esxi:hostd","channel":"/var/log/hostd.log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"ExecutionSource","description":"Script loaded from mounted datastore, SSH upload, or dropped via guest-to-host tools."},{"field":"HostUser","description":"Python launched under root or unknown user."},{"field":"InstallPath","description":"Custom Python binaries or packages in non-default paths (/tmp/python/bin/python3)."}],"live":true,"detection_strategies":["DET0063"],"techniques":["T1059.006"]}],"live":true,"version":"1.0","techniques":["T1059.006"]}],"sigma_rules":[{"id":"0a23a62d-c5b3-468b-a072-25064a9a8c87","title":"Axios NPM Compromise Indicators - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-01","modified":null,"description":"Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.\nOn March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.\nThe dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.\n","references":["https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan","https://www.derp.ca/research/axios-npm-supply-chain-rat/","https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html","https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections","https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.command-and-control","attack.t1059.006","attack.t1059.004","attack.t1105","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml","techniques":["T1195.002","T1059.006","T1059.004","T1105"],"cves":[]},{"id":"1f32d820-1d5c-43fe-8fe2-feef0c952eb7","title":"Emotet Loader Execution Via .LNK File","author":"@kostastsale","status":"test","level":"high","date":"2022-04-22","modified":"2024-08-15","description":"Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022.\nThe \".lnk\" file was delivered via phishing campaign.\n","references":["https://web.archive.org/web/20220422215221/https://twitter.com/malware_traffic/status/1517622327000846338","https://twitter.com/Cryptolaemus1/status/1517634855940632576","https://tria.ge/220422-1pw1pscfdl/","https://tria.ge/220422-1nnmyagdf2/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.006","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml","techniques":["T1059.006"],"cves":[]},{"id":"3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e","title":"TanStack Supply-Chain Attack Execution Indicators - Linux","author":"Leonardo Gasparini","status":"experimental","level":"high","date":"2026-05-12","modified":null,"description":"Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.\nThe preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.\n","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.007","attack.t1059.006","attack.t1204.002","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_lnx_malware_tanstack_supply_chain.yml","techniques":["T1059.007","T1059.006","T1204.002"],"cves":[]},{"id":"401e5d00-b944-11ea-8f9a-00163ecd60ae","title":"AppLocker Prevented Application or Script from Running","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-28","modified":"2025-12-03","description":"Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://nxlog.co/documentation/nxlog-user-guide/applocker.html"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"4f394635-13ef-4599-b677-3353e0f84f55","title":"Python Path Configuration File Creation - MacOS","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2024-04-25","modified":null,"description":"Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.\nModules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.\nDefault paths are '\\lib\\site-packages\\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).\n","references":["https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac","https://docs.python.org/3/library/site.html"],"logsource":{"product":"macos","category":"file_event"},"tags":["attack.execution","attack.t1059.006","detection.threat-hunting"],"path":"rules-threat-hunting/macos/file/file_event/file_event_macos_python_path_configuration_files.yml","techniques":["T1059.006"],"cves":[]},{"id":"50a0aa3d-ab16-4594-a8aa-5145a6e6792b","title":"Python One-Liners with Base64 Decoding","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":null,"description":"Detects Python one-liners that use base64 decoding functions in command line executions.\nMalicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml","techniques":["T1059.006","T1027.010"],"cves":[]},{"id":"557e3bd3-7f21-495d-8d50-7c8bdfb8041c","title":"AppLocker Application Would Have Been Blocked","author":"heyyanu","status":"experimental","level":"medium","date":"2026-03-26","modified":null,"description":"Detects when AppLocker \"Audit only\" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker \"Enforce rules\" enforcement mode was enabled.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"55e862a8-dd9c-4651-807a-f21fcad56716","title":"Python One-Liners with Base64 Decoding - Linux","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":null,"description":"Detects the use of Python's base64 decoding functions in command line executions on Linux systems.\nMalicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"path":"rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml","techniques":["T1059.006","T1027.010"],"cves":[]},{"id":"5660d8db-6e25-411f-b92f-094420168a5d","title":"Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution","author":"@kostastsale","status":"test","level":"medium","date":"2022-04-25","modified":null,"description":"Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.\nAs reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat \"prunsrv.exe\" process application.\n","references":["https://blog.morphisec.com/vmware-identity-manager-attack-backdoor","https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.t1059.006","attack.t1190","cve.2022-22954","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml","techniques":["T1059.006","T1190"],"cves":["CVE-2022-22954"]},{"id":"9637e8a5-7131-4f7f-bdc7-2b05d8670c43","title":"Suspicious File Characteristics Due to Missing Fields","author":"Markus Neis, Sander Wiebing","status":"test","level":"medium","date":"2018-11-22","modified":"2022-10-09","description":"Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe","references":["https://securelist.com/muddywater/88059/","https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.006"],"path":"rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml","techniques":["T1059.006"],"cves":[]},{"id":"d5eb7432-fda4-4bba-a37f-ffa74d9ed639","title":"Serpent Backdoor Payload Execution Via Scheduled Task","author":"@kostastsale","status":"test","level":"high","date":"2022-03-21","modified":null,"description":"Detects post exploitation execution technique of the Serpent backdoor.\nAccording to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.\nIt creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.\n","references":["https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.006","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml","techniques":["T1053.005","T1059.006"],"cves":[]},{"id":"e3652ba3-0ad8-4010-a957-b7ba369e7bac","title":"Python Path Configuration File Creation - Windows","author":"Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-04-25","modified":null,"description":"Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.\nModules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.\nDefault paths are '\\lib\\site-packages\\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).\n","references":["https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac","https://docs.python.org/3/library/site.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.006","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_event/file_event_win_python_path_configuration_files.yml","techniques":["T1059.006"],"cves":[]},{"id":"fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce","title":"Python Path Configuration File Creation - Linux","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2024-04-25","modified":null,"description":"Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.\nModules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.\nDefault paths are '\\lib\\site-packages\\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).\n","references":["https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac","https://docs.python.org/3/library/site.html"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.t1059.006","detection.threat-hunting"],"path":"rules-threat-hunting/linux/file/file_event/file_event_lnx_python_path_configuration_files.yml","techniques":["T1059.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}