AN0172
Analytic 0172
Windows
Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.
WinEventLog:Sysmon
EventCode=1
EDR:hunting
Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents
[ParentProcess]
Non-standard processes spawning python.exe (e.g., winword.exe, mshta.exe).
[ScriptPath]
Execution of .py from temp directories or user profile paths.
[TimeWindow]
Execution outside maintenance or patch windows.
[UserContext]
Execution by low-privileged or service accounts.
[ChildProcess]
Python spawning suspicious binaries or scripts (e.g., PowerShell, certutil).
AN0173
Analytic 0173
macOS
Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.
macos:unifiedlog
log stream --predicate 'eventMessage contains "python"'
macos:osquery
process_events
macos:syslog
system.log
[ExecutionPath]
Detects python scripts from ~/Downloads/, /Volumes/, or /tmp/.
[ScriptName]
Obfuscated or high entropy script names.
[SpawnChain]
Chained behavior: Python → bash → curl or Python → osascript.
AN0174
Analytic 0174
Linux
Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).
auditd:SYSCALL
execve
linux:syslog
/var/log/syslog
[ScriptDir]
Script invoked from /tmp, /var/tmp, or .hidden/ folders.
[ScheduledContext]
Execution from user cron or systemd timers outside of approved scripts.
[NetworkActivity]
Python performing HTTP/HTTPS without package updates.
AN0175
Analytic 0175
ESXi
Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.
esxi:vobd
/var/log/vobd.log
esxi:hostd
/var/log/hostd.log
[ExecutionSource]
Script loaded from mounted datastore, SSH upload, or dropped via guest-to-host tools.
[HostUser]
Python launched under root or unknown user.
[InstallPath]
Custom Python binaries or packages in non-default paths (/tmp/python/bin/python3).