Detection rules › Sigma
Python Initiated Connection
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1046 Network Service Discovery |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 3 | Network connection |
Stages and Predicates
Stage 1: selection
Image|contains: .exe
Image|contains: '\python'
Initiated: true
Stage 2: not 1 of filter_main_*
or:
CommandLine|contains: install
CommandLine|contains: pip.exe
DestinationIp: 127.0.0.1
SourceIp: 127.0.0.1
Stage 3: not 1 of filter_optional_*
or:
CommandLine|contains: ':\ProgramData\Anaconda3\Scripts\conda-script.py'
CommandLine|contains: update
ParentImage: 'C:\ProgramData\Anaconda3\Scripts\conda.exe'
CommandLine|contains: 'C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py'
ParentImage: 'C:\ProgramData\Anaconda3\python.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
DestinationIp | eq |
|
Image | match |
|
Initiated | eq |
|
ParentImage | eq |
|
SourceIp | eq |
|