Event Triggered Execution: Python Startup Hooks T1546.018

Tactics: Persistence, Privilege Escalation

Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (`.pth`) files and the `sitecustomize.py` or `usercustomize.py` modules. These files are automatically processed during the initialization of the Python interpreter, allowing for the execution of arbitrary code whenever Python is invoked.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Image2is_not_null 2
TargetFilename2wildcard 2/home/*/.config/python/usercustomize.py, /home/*/.local/lib/python*/site-packages/*, /home/*/.local/lib/python*/site-packages/usercustomize.py, /opt/*/lib/python*/site-packages/*, /opt/*/lib/python*/sitecustomize.py
host.os.type2eq 2
EventType1eq 1creation
event.type1eq 1creation
file.extension1eq 1pth

Top indicator values (16 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
creation
158
TargetFilenamewildcard
/home/*/.config/python/usercustomize.py
1
TargetFilenamewildcard
/home/*/.local/lib/python*/site-packages/*
1
TargetFilenamewildcard
/home/*/.local/lib/python*/site-packages/usercustomize.py
1
TargetFilenamewildcard
/opt/*/lib/python*/site-packages/*
1
TargetFilenamewildcard
/opt/*/lib/python*/sitecustomize.py
1
TargetFilenamewildcard
/usr/lib/python*/dist-packages/*
1
TargetFilenamewildcard
/usr/lib/python*/dist-packages/sitecustomize.py
1
TargetFilenamewildcard
/usr/lib/python*/site-packages/*
1
TargetFilenamewildcard
/usr/lib/python*/sitecustomize.py
1
TargetFilenamewildcard
/usr/local/lib/python*/dist-packages/*
1
TargetFilenamewildcard
/usr/local/lib/python*/dist-packages/sitecustomize.py
1
TargetFilenamewildcard
/usr/local/lib/python*/site-packages/*
1
TargetFilenamewildcard
/usr/local/lib/python*/sitecustomize.py
1
event.typeeq
creation
152
file.extensioneq
pth
13

Exclusions (27 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imagein
./usr/bin/podman
2
Imagein
/kaniko/executor
2
Imagein
/usr/bin/crio
2
Imagein
/usr/bin/dockerd
2
Imagein
/usr/bin/pacman
2
Imagein
/usr/bin/pamac-daemon
2
Imagein
/usr/bin/podman
2
Imagein
/usr/bin/restic
2
Imagein
/bin/dnf5
1
Imagein
/bin/podman
1
Imagein
/dev/fd/3
1
Imagein
/opt/conda/_conda
1
Imagein
/opt/miniforge3/bin/mamba
1
Imagewildcard
/nix/store/*libexec/docker/dockerd
2
Imagewildcard
/snap/docker/*dockerd
2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint

Elastic 2 rules