Query: rule covering Detects a Python process initiating a network connection. While this often relates to package installation, it can also
Matching passage: Sigma rule: Detects a Python process initiating a network connection. While this often relates to package installation, it can also. Logsource: windows / network_connection. Rule: title: Python Initiated Connection id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6 status: test description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python - https://pypi.org/project/scapy/ author: frack113 date: 2021-12-10 modified: 2025-03-05 tags: - attack.discovery - attack.t1046 logsource: category: network_connection product: windows definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type' detection: selection: Initiated: 'true' Image|contains|all: - \python - .exe filter_optional_conda: ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe CommandLine|contains|all: - :\ProgramData\Anaconda3\Scripts\conda-script.py - update filter_optional_conda_jupyter_notebook: ParentImage: C:\ProgramData\Anaconda3\python.exe CommandLine|contains: C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py filter_main_local_communication: DestinationIp: 127.0.0.1 SourceIp: 127.0.0.1 filter_main_pip: CommandLine|contains|all: - pip.exe - install condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying. level: medium
Near-miss passage: Sigma rule: Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to. Logsource: windows / process_creation. Rule: title: Suspicious Copy From or To System Directory id: fff9d2b7-e11c-4a69-93d3-40ef66189767 related: - id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 type: derived status: test description: 'Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as ''certutil'' or ''desktopimgdownldr'' to a different location with a different name in order to bypass detections based on locations. ' references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2026-03-16 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_img_cmd: Image|endswith: \cmd.exe CommandLine|contains: 'copy ' selection_img_pwsh: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - copy-item - ' copy ' - 'cpi ' - ' cp ' selection_img_other: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_target: CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS) filter_optional_avira: Image|endswith: \cmd.exe CommandLine|contains|all: - /c copy - \Temp\ - \avira_system_speedup.exe CommandLine|contains: - C:\Program Files\Avira\ - C:\Program Files (x86)\Avira\ condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_* falsepositives: - Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/) - When cmd.exe and xcopy.exe are called directly - When the command contains the keywords but not in the correct order level: medium