Python startup hook file written on Linux

1title: Python startup hook file written on Linux2id: 277bcf8c-7924-4a0c-971e-0f87e0e899783status: experimental4description: |5  Matches the file-modification leg of AN0713: an auditd PATH record naming one6  of the files the Python interpreter processes on its own during startup. Two7  arms cover the two mechanisms MITRE describes. The first requires both a8  `.pth` suffix and a `site-packages` or `dist-packages` component in the same9  path, because a `.pth` file only executes its `import` lines when it sits in10  a site directory — matching `.pth` anywhere would fire on unrelated files and11  matching the directory alone would fire on every package file installed. The12  second arm needs no directory constraint: `sitecustomize.py` and13  `usercustomize.py` are imported from anywhere on `sys.path`, so the filename14  is the whole signal. Both are anchored on the filename with `endswith` rather15  than on an absolute path, because auditd records `name=` exactly as it was16  handed to the syscall, so a write performed from inside the directory logs a17  bare `sitecustomize.py` with no leading path at all. This is MITRE's18  `HookFilePathPatterns` knob, populated here with the Debian and RHEL site19  directory names and the two customize modules rather than taken from MITRE;20  a site that keeps virtual environments under a fixed root can tighten the21  first arm to that root and cut most of the noise below.22  Scope and limits. Only the write is a single event. The analytic's second23  half — a python3 execve shortly afterwards, with anomalous children or24  outbound connections, inside MITRE's `TimeWindow` knob — is a cross-event25  correlation lib/sigma has no way to express, and its `InterpreterWhitelist`26  knob applies to that execution rather than to this write. MITRE's27  `UserContext` knob cannot be applied inside this selection either: auditd28  emits PATH and SYSCALL as separate records for one event and the writing29  process's `exe`, `uid` and `auid` live only on the SYSCALL side. The30  technique is listed for Windows and macOS as well, but the brief carries one31  analytic and it is Linux-only, so neither platform is attempted here.32  Prerequisite: auditd watches none of these paths by default, so this rule33  returns zero rows until watches such as34  `-w /usr/lib/python3/dist-packages -p wa -k python_hooks` and one per35  additional interpreter or virtual-environment root are loaded — and zero rows36  reads as quiet when it actually means blind. Virtual environments created in37  user home directories are the practical gap: they hold their own38  site-packages and no fleet-wide watch list can enumerate them in advance.39  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0258, not hand-written and not tested by its author. Any lab result is on this rule's own page.40references:41  - https://attack.mitre.org/techniques/T1546/01842  - https://attack.mitre.org/detectionstrategies/DET025843author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)44date: 2026-08-1745tags:46  - attack.persistence47  - attack.privilege-escalation48  - attack.t1546.01849logsource:50  product: linux51  service: auditd52detection:53  selection_site_dir:54    type: 'PATH'55    name|contains:56      - '/site-packages/'57      - '/dist-packages/'58  selection_pth_file:59    type: 'PATH'60    name|endswith: '.pth'61  selection_customize_module:62    type: 'PATH'63    name|endswith:64      - 'sitecustomize.py'65      - 'usercustomize.py'66  condition: (selection_site_dir and selection_pth_file) or selection_customize_module67falsepositives:68  - "Package installation. pip and setuptools write .pth files into site-packages as a matter of course — distutils-precedence.pth ships with setuptools itself, namespace packages install a -nspkg.pth, and pip install -e writes an __editable__ .pth per editable project. Any pip install on any host can match, which makes this the loudest source by a wide margin and is why the level is low rather than medium."69  - "Virtual environment creation. venv, virtualenv, tox, poetry and conda each write a _virtualenv.pth or an equivalent into the new environment's site-packages, so every developer workstation and every CI job that builds a fresh environment emits a burst of matches."70  - "Distribution package upgrades of the interpreter itself. Debian and Ubuntu ship a sitecustomize.py under /usr/lib/python3.x and RHEL ships one alongside its site-packages, so an apt or dnf upgrade of python3 rewrites the exact filename this rule's second arm is anchored on."71  - "Configuration management and image builds replaying the same environment on every convergence run or every image: an Ansible pip task, a Dockerfile RUN pip install layer, or a Puppet or Chef python resource, all of which reinstall the same packages and rewrite the same .pth files whether or not anything changed."72  - "Editors and installers writing through a temporary file and renaming it into place, which emits several PATH records for a single logical modification of one hook file."73level: low