Query: detect Detects a Python process initiating a network connection. While this often relates to package installation, it can also in logs
Matching passage: Sigma rule: Detects a Python process initiating a network connection. While this often relates to package installation, it can also. Logsource: windows / network_connection. Rule: title: Python Initiated Connection id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6 status: test description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python - https://pypi.org/project/scapy/ author: frack113 date: 2021-12-10 modified: 2025-03-05 tags: - attack.discovery - attack.t1046 logsource: category: network_connection product: windows definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type' detection: selection: Initiated: 'true' Image|contains|all: - \python - .exe filter_optional_conda: ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe CommandLine|contains|all: - :\ProgramData\Anaconda3\Scripts\conda-script.py - update filter_optional_conda_jupyter_notebook: ParentImage: C:\ProgramData\Anaconda3\python.exe CommandLine|contains: C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py filter_main_local_communication: DestinationIp: 127.0.0.1 SourceIp: 127.0.0.1 filter_main_pip: CommandLine|contains|all: - pip.exe - install condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying. level: medium
Near-miss passage: Sigma rule: Detects presence of a potentially xor encoded powershell command. Logsource: windows / process_creation. Rule: title: Suspicious XOR Encoded PowerShell Command id: bb780e0c-16cf-4383-8383-1e5471db6cf9 related: - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6 type: obsolete status: test description: Detects presence of a potentially xor encoded powershell command references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://redcanary.com/blog/yellow-cockatoo/ - https://zero2auto.com/2020/05/19/netwalker-re/ - https://mez0.cc/posts/cobaltstrike-powershell-exec/ author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali date: 2018-09-05 modified: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Description: Windows PowerShell - Product: PowerShell Core 6 selection_cli_xor: CommandLine|contains: bxor selection_cli_other: CommandLine|contains: - ForEach - for( - 'for ' - '-join ' - -join' - -join" - -join` - ::Join - '[char]' condition: all of selection_* falsepositives: - Unknown level: medium