Python interpreter spawned by a document or script host

1title: Python interpreter spawned by a document or script host2id: 1995db3a-f5c0-4627-a564-aecece69fcdc3status: experimental4description: |5  Matches a Python interpreter process whose parent is an Office application,6  a script host or a signed-binary proxy, which is the lineage half of AN0172.7  Python itself is unremarkable on a Windows estate, so the parent list is the8  entire detection: it populates MITRE's ParentProcess knob, and the twelve9  parents named are authored here rather than taken from MITRE, which names10  only winword.exe and mshta.exe as examples. py.exe and pyw.exe are in the11  child list on purpose — the launcher execs python.exe as its own child, so12  in a Word-to-py.exe-to-python.exe chain only the py.exe event still carries13  winword.exe as ParentImage and a list of python.exe alone would miss it.14  Known gap in the child list: endswith cannot see version-suffixed15  interpreters such as python3.12.exe or the embedded runtimes some vendors16  ship under their own product name, so a payload launched through one of17  those is invisible here. MITRE's ScriptPath knob (a .py under a temp or18  profile directory) is not used, because on Sysmon EventID 1 the script path19  sits in CommandLine only when it was passed as an argument, and requiring20  that would drop the -c one-liner form entirely. The rule is written in the21  Sysmon EventID 1 vocabulary the brief names; if Security 4688 feeds this22  category instead, ParentProcessName is the field name there and Audit23  Process Creation must be enabled first.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0063, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1059/00627  - https://attack.mitre.org/detectionstrategies/DET006328author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.execution32  - attack.t1059.00633logsource:34  category: process_creation35  product: windows36detection:37  selection_python:38    Image|endswith:39      - '\python.exe'40      - '\pythonw.exe'41      - '\python3.exe'42      - '\py.exe'43      - '\pyw.exe'44  selection_parent:45    ParentImage|endswith:46      - '\winword.exe'47      - '\excel.exe'48      - '\powerpnt.exe'49      - '\outlook.exe'50      - '\msaccess.exe'51      - '\visio.exe'52      - '\mshta.exe'53      - '\wscript.exe'54      - '\cscript.exe'55      - '\regsvr32.exe'56      - '\rundll32.exe'57      - '\wmiprvse.exe'58  condition: selection_python and selection_parent59falsepositives:60  - "Excel automation add-ins that embed Python by design — xlwings, PyXLL, the Anaconda and Bloomberg Excel integrations — where excel.exe launching python.exe is the product working correctly; on a finance or research workstation with one of these installed this is the highest-volume match by a wide margin and repeats on every recalculation."61  - "Word, Outlook and Access add-ins from reporting and RPA vendors that shell out to a bundled Python runtime to render a document, parse an attachment or drive a data refresh."62  - "Endpoint management and inventory that executes scripts over WMI or WinRM, which makes wmiprvse.exe the parent of a vendor-bundled python.exe on a schedule across the whole estate."63  - "Legacy in-house automation kept in .vbs or .js wrappers under wscript.exe or cscript.exe that call a Python helper, common where a team migrated its scripts piecemeal."64level: medium