Suspicious Network Activity During Python Package Installation

Adversaries are increasingly leveraging the Python ecosystem to facilitate software supply chain compromises by embedding malicious logic within package build processes. Specifically, threat actors can manipulate setup.py scripts or leverage setuptools command classes to execute arbitrary code the moment a user or automated system executes a pip install command. This activity allows for the establishment of C2 beacons or data exfiltration directly from build-time processes, often bypassing traditional perimeter defenses. Detection requires monitoring for anomalous outbound network connections originating from Python processes during the package build or installation lifecycle. This behavior is significant as it provides attackers with immediate execution and network access upon the deployment of a seemingly legitimate package.

Attack Chain

1. Attacker publishes a malicious package to a public or private repository (e.g., PyPI) containing an obfuscated or legitimate-looking setup.py file.
2. A victim or build server executes 'pip install' for the malicious package.
3. The Python environment invokes the package's build process, triggering the execution of the malicious setup.py or associated install scripts.
4. The malicious script utilizes setuptools command classes to gain execution context within the Python process.
5. The Python process initiates an unauthorized outbound network connection (e.g., via socket or request libraries) to an attacker-controlled C2 domain.
6. The attacker receives a beacon, confirming the successful installation and environment foothold.
7. The attacker proceeds with secondary payload delivery or data exfiltration from the build environment.

Impact

Successful exploitation of this technique can lead to complete compromise of build infrastructure, source code theft, or the injection of malicious code into downstream software products. This poses a significant risk to CI/CD pipelines and developer workstations, potentially impacting entire organizations through compromised software updates.

Recommendation

• Enable Sysmon process-creation (Event ID 1) and network-connection (Event ID 3) logging on all developer workstations and build servers.
• Deploy the Sigma rules below to monitor for Python processes initiating network connections during build-wheel processes.
• Investigate any network destinations contacted by Python during package installation that do not align with known, trusted software repositories or mirror sites.
• Implement environment-specific allowlisting for network egress from build processes to limit unauthorized C2 communication.