deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: defense evasion python library load and delete

# Python Library Load and Delete

---

## Metadata

- **Author:** Elastic
- **Description:** Detects when a Python process loads a library from a user's home directory and then deletes that library within a short time window. This may indicate an attempt to execute malicious code in memory and remove evidence from disk as a form of defense evasion.

- **UUID:** `76a1f901-4495-4cbd-a35a-7ff8d116602b`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Python Library Load and Delete](../queries/defense_evasion_python_library_load_and_delete.toml)

## Query

```sql
sequence by process.entity_id with maxspan=15s
  [library where event.action == "load" and dll.path like "/Users/*" and process.name like~ "python"]
  [file where event.action == "deletion" and startswith~(file.path, dll.path)]
```

## Notes

- This hunting rule helps identify potential in-memory execution or anti-forensic behavior by Python-based malware.
- Library load followed by quick deletion is suspicious, especially in user directories.
- Consider pivoting on `process.entity_id` to examine surrounding process activity and file writes.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1070.004](https://attack.mitre.org/techniques/T1070/004)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via suspicious launch agent or launch daemon with low occurrence

# Low Occurrence of Suspicious Launch Agent or Launch Daemon

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt looks for persistence via Launch agent or daemon where the distribution is limited to one unique host.

- **UUID:** `69fc4f40-8fb1-4652-99b7-52755cd370fe`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Low Occurrence of Suspicious Launch Agent or Launch Daemon](../queries/persistence_via_suspicious_launch_agent_or_launch_daemon_with_low_occurrence.toml)

## Query

```sql
from logs-endpoint.events.file-*
| where  @timestamp > now() - 7 day
| where host.os.family == "macos" and event.category == "file" and event.action == "launch_daemon" and
  (Persistence.runatload == true or Persistence.keepalive == true) and process.executable is not null
| eval args = MV_CONCAT(Persistence.args, ",")
 /* normalizing users home profile */
| eval args = replace(args, """/Users/[a-zA-Z0-9ñ\.\-\_\$~ ]+/""", "/Users/user/")
| stats agents = count_distinct(host.id), total = count(*) by process.name, Persistence.name, args
| where starts_with(args, "/") and agents == 1 and total == 1
```

## Notes

- Further investigation can done pivoting by `Persistence.name` and `args`.

## MITRE ATT&CK Techniques

- [T1547](https://attack.mitre.org/techniques/T1547)
- [T1547.011](https://attack.mitre.org/techniques/T1547/011)
- [T1543](https://attack.mitre.org/techniques/T1543)
- [T1543.001](https://attack.mitre.org/techniques/T1543/001)
- [T1543.004](https://attack.mitre.org/techniques/T1543/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: suspicious network connections by unsigned macho

# Suspicious Network Connections by Unsigned Mach-O

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt aggregates by process ID and destination IP by the number of connections per hour over a period of time greater than a defined threshold. This may indicate suspicious network connections by unsigned Mach-O binaries.

- **UUID:** `dc04d70a-80aa-4c3f-ad02-2b18d54af6d4`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Suspicious Network Connections by Unsigned Mach-O](../queries/suspicious_network_connections_by_unsigned_macho.toml)

## Query

```sql
from logs-endpoint.events.network-*
| where @timestamp > now() - 7 day
| where host.os.family == "macos" and event.category == "network" and
  (process.code_signature.exists == false or process.code_signature.trusted != true) and
  /* excluding private IP ranges */
  not CIDR_MATCH(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1","FE80::/10", "FF00::/8")
| keep source.bytes, destination.address, process.name, process.entity_id, @timestamp
 /* calc total duration, total MB out, and the number of connections per hour */
| stats total_bytes_out = sum(source.bytes), count_connections = count(*), start_time = min(@timestamp), end_time = max(@timestamp) by process.entity_id, destination.address, process.name
| eval dur = TO_DOUBLE(end_time)-TO_DOUBLE(start_time), duration_hours=TO_INT(dur/3600000), MB_out=TO_DOUBLE(total_bytes_out) / (1024*1024), number_of_con_per_hour = (count_connections / duration_hours)
| keep process.entity_id, process.name, duration_hours, destination.address, MB_out, count_connections, number_of_con_per_hour
/* threshold is set to 120 connections per minute, you can adjust it to your env/FP rate */
| where duration_hours >= 8 and number_of_con_per_hour >= 120
```

## Notes

- This hunt returns a list of processes by entity_id and name that have a high number of connections per hour over a period of time greater than a defined threshold.
- Pivoting by `process.entity_id` will allow further investigation (parent process, hash, child processes, other network events etc.).

## MITRE ATT&CK Techniques

- [T1071](https://attack.mitre.org/techniques/T1071)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: credential access potential python stealer

# Potential Python Stealer Activity

---

## Metadata

- **Author:** Elastic
- **Description:** Detects the execution of a Python script followed by at least three consecutive open actions on files within a 30-second window. This behavior may indicate an attempt to access or exfiltrate sensitive data such as browser files, credentials, or configuration files.

- **UUID:** `107fe9a2-6743-4136-a055-fa070fd38f2f`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Potential Python Stealer Activity](../queries/credential_access_potential_python_stealer.toml)

## Query

```sql
sequence by process.entity_id with maxspan=30s
  [process where event.type == "start" and event.action == "exec" and
    process.name like~ "python*" and process.args_count == 2 and
    process.args like ("/Users/*", "/tmp/*", "/private/tmp/*")]
  [file where event.action == "open"]
  [file where event.action == "open"]
  [file where event.action == "open"]
```

## Notes

- This hunt identifies Python-based access to multiple files shortly after script execution, a pattern common to stealers.
- Adjustments may be needed to focus on high-value file paths (e.g., browser data, tokens, configuration files).
- Further pivoting on `file.path`, `process.entity_id`, and `process.args` is recommended for triage.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1552.001](https://attack.mitre.org/techniques/T1552/001)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution python script drop and execute

# Python Script Drop and Execute

---

## Metadata

- **Author:** Elastic
- **Description:** Detects when a Python script is written to disk within a user's home directory and then immediately executed by the same process lineage. This pattern is commonly observed in initial access payload delivery or script-based malware staging.

- **UUID:** `76f10746-9527-4c99-8ed8-491085ecdcfd`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Python Script Drop and Execute](../queries/execution_python_script_drop_and_execute.toml)

## Query

```sql
sequence with maxspan=15s
  [file where event.action == "modification" and process.name like~ "python*" and
   file.extension == "py" and file.path like "/Users/*"] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and
   process.args_count == 2 and process.args like "/Users/*"] by process.parent.entity_id
```

## Notes

- This hunt is designed to catch malicious tooling written and executed rapidly by Python processes.
- This technique is often used by downloaders or droppers that write staging scripts and immediately run them.
- Consider pivoting on `process.entity_id` and `file.path` to view subsequent behavior.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1105](https://attack.mitre.org/techniques/T1105)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: command and control suspicious executable file creation via python

# Suspcious Executable File Creation via Python

---

## Metadata

- **Author:** Elastic
- **Description:** Detects suspicious creation of executable files by Python processes in commonly abused directories 
on macOS systems. These locations, such as /Users/Shared, /tmp, or /private/tmp, are frequently used by adversaries 
and post-exploitation frameworks to stage or drop payloads. The detection leverages the ELF or Mach-O magic bytes 
to confirm executables are written to disk.

- **UUID:** `9aaf1113-cf7a-4fd7-b796-f6456fdaffb5`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Suspcious Executable File Creation via Python](../queries/command_and_control_suspicious_executable_file_creation_via_python.toml)

## Query

```sql
file where event.action == "modification" and
  process.name like~ "python*" and
  file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
  file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Users/*/Public/*") and
  not file.extension in ("dylib", "so")
```

## Notes

- Creation or modification of executable binaries in these directories is odd and rare in normal operations.
- This hunt is useful for detecting dropper-style behavior during post-exploitation or initial access.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1105](https://attack.mitre.org/techniques/T1105)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution unusual library load via python

# Unusual Library Load via Python

---

## Metadata

- **Author:** Elastic
- **Description:** Detects when a library is loaded from a user's home directory by a Python process and the loaded file is not a typical shared object (.so) or dynamic library (.dylib). This may indicate side-loading of malicious or non-standard files in script-based execution environments.

- **UUID:** `d9b30b84-dc53-413c-a7e4-f42078b10048`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Unusual Library Load via Python](../queries/execution_unusual_library_load_via_python.toml)

## Query

```sql
library where event.action == "load" and
  dll.path like "/Users/*" and
  process.name like~ "python*" and
  not dll.name : ("*.so", "*.dylib")
```

## Notes

- Loading libraries from /Users is rare and may suggest untrusted or attacker-deployed components.
- This hunt helps uncover suspicious Python-driven library loads that bypass traditional extension-based detection.
- Consider tuning to exclude known development or research environments that store legitimate libraries in home directories.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution suspicious python app execution via streamlit

# Suspicious Python App Execution via Streamlit

---

## Metadata

- **Author:** Elastic
- **Description:** Detects execution of a Python application using Streamlit followed shortly by an outbound network connection. This pattern was seen in the Safe/ByBit breach and may indicate abuse of Streamlit to stage or serve a malicious interface during initial access operations.

- **UUID:** `04d4b300-bf2f-4e86-8fab-c51502a1db32`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Suspicious Python App Execution via Streamlit](../queries/execution_suspicious_python_app_execution_via_streamlit.toml)

## Query

```sql
sequence by process.entity_id with maxspan=2m
  [process where event.type == "start" and event.action == "exec" and
    process.name like~ "python*" and
    process.args like ("/Users/*/Downloads/*streamlit", "/Users/*/Desktop/*streamlit", "/Users/*/Documents/*streamlit") and
    process.args == "run" and process.args : "*.py" and
    process.args_count == 4]
  [network where event.type == "start" and destination.domain != null and
    not cidrmatch(destination.ip,
      "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15",
      "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
      "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
      "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
      "::1", "FE80::/10", "FF00::/8")]
```

## Notes

- This hunt identifies Python apps run via Streamlit from user directories, immediately followed by external network activity.
- Streamlit-based payloads may abuse the framework to present fake interfaces or interactive apps during initial access.
- Outbound connection filtering avoids internal IPs and infrastructure — can be tuned to your network space.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1105](https://attack.mitre.org/techniques/T1105)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: defense evasion self deleted python script outbound network connection

# Self-Deleted Python Script Outbound Network Connection

---

## Metadata

- **Author:** Elastic
- **Description:** Detects an outbound network connection by a Python script that was executed and deleted from disk. A recent DPRK 
initial access campaign used a Python script that self 
deletes and continues operating in memory.
- **UUID:** `04d4b300-bf2f-4e86-8fab-c51502a1db32`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Self-Deleted Python Script Outbound Network Connection](../queries/defense_evasion_self_deleted_python_script_outbound_network_connection.toml)

## Query

```sql
sequence by process.entity_id with maxspan=10s
[file where event.action == "deletion" and file.extension in ("py", "pyc") and process.name like~ "python*"] 
[network where event.type == "start" and
   not cidrmatch(destination.ip, 
       "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
       "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", 
       "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "::1", "FE80::/10", "FF00::/8")]
```

## Notes

- This hunt identifies a deleted Python script followed immediately followed by external network activity from the same process.
- Outbound connection filtering avoids internal IPs and infrastructure — can be tuned to your network space.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1105](https://attack.mitre.org/techniques/T1105)
- [T1070.004](https://attack.mitre.org/techniques/T1070/004)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution unsigned or untrusted binary execution via python

# Unsigned or Untrusted Binary Execution via Python

---

## Metadata

- **Author:** Elastic
- **Description:** Detects the execution of unsigned or untrusted binaries where the parent process is a Python interpreter. Adversaries often use Python as a launcher to run untrusted payloads, typically dropped to locations like `/tmp`, `/Users/Shared`, or public directories. This behavior is indicative of custom loaders, malware staging, or post-exploitation actions.

- **UUID:** `9aaf1113-cf7a-4fd7-b796-f6456fdaffb5`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Unsigned or Untrusted Binary Execution via Python](../queries/execution_unsigned_or_untrusted_binary_execution_via_python.toml)

## Query

```sql
process where event.type == "start" and event.action == "exec" and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and
  process.parent.name like~ "python*" and
  (
    process.executable like "/Users/Shared/*" or
    process.executable like "/tmp/*" or
    process.executable like "/private/tmp/*" or
    process.executable like "/Users/*/Public/*" or
    process.name like ".*"
  )
```

## Notes

- Execution of untrusted binaries from Python in shared or temporary directories is rare in normal operations.
- This hunt is useful for detecting dropper-style behavior during post-exploitation or initial access.
- You may wish to enrich with file.hash or process.args to gain more triage context.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1105](https://attack.mitre.org/techniques/T1105)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: defense evasion self deleting python script

# Self-Deleting Python Script

---

## Metadata

- **Author:** Elastic
- **Description:** Detects when a Python script is executed and then deletes itself within a short time window. This behavior is often observed in malware used by DPRK threat actors to remove traces post-execution and avoid detection.

- **UUID:** `6461f45e-b03f-4756-94d2-34a210caeb78`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Self-Deleting Python Script](../queries/defense_evasion_self_deleting_python_script.toml)

## Query

```sql
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and
    process.name like~ "python*" and process.args_count == 2 and
    process.args like ("/Users/Shared/*.py", "/tmp/*.py", "/private/tmp/*.py", "/Users/*/Public/*.py")]
  [file where event.action == "deletion" and
    file.extension in ("py", "pyc") and
    file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Users/*/Public/*")]
```

## Notes

- Self-deletion of Python scripts is commonly used to evade detection and forensic recovery.
- This hunt is effective at uncovering ephemeral post-exploitation scripts or loaders.
- You may pivot on `file.path`, `process.args`, and `process.executable` to understand intent and targets.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1070.004](https://attack.mitre.org/techniques/T1070/004)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`