Event Triggered Execution: Python Startup Hooks T1546.018
Tactics: Persistence, Privilege Escalation
Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (`.pth`) files and the `sitecustomize.py` or `usercustomize.py` modules. These files are automatically processed during the initialization of the Python interpreter, allowing for the execution of arbitrary code whenever Python is invoked.
Authoring guide
These 2 rules share fields, values, and exclusions.
Fields filtered most (6 distinct)
These fields appear most often in rule filters.
Top indicator values (16 distinct)
These values appear most often in rule predicates.
Exclusions (27 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: Linux
Domain: Endpoint