ATT&CK coverage › Technique

Command and Scripting Interpreter: Python T1059.006

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Events covered

5 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
AppLocker8004FilePathBuffer was prevented from running.
AppLocker8007FilePathBuffer was prevented from running.
AppLocker8022PackageBuffer was prevented from running.
AppLocker8025PackageBuffer was prevented from running.

Authoring guide

Patterns shared across the 3 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (7 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image2match 2\python, \Downloads\
OriginalFileName1match 1python
CommandLine1match 1 -c, b32decode, import
FileVersion1eq 1\?
Product1eq 1\?
Description1eq 1\?
Company1eq 1\?

Top indicator values (17 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
CommandLinematchz85decode1
Imagematch\python12
CommandLinematchb32hexdecode1
OriginalFileNamematchpython1
CommandLinematchimport12
CommandLinematchb16decode1
CommandLinematch -c14
CommandLinematch.decode1
CommandLinematchb85decode1
CommandLinematchbase641
CommandLinematchb32decode1
CommandLinematchb64decode1
Imagematch\Downloads\18
Descriptioneq\?1
Producteq\?1
Companyeq\?1
FileVersioneq\?1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 3 rules