Abuse of PYTHONPATH for Python Module Hijacking and Persistence

Adversaries are targeting Python environments by manipulating the PYTHONPATH environment variable, a mechanism used by the Python interpreter to locate modules for import. By altering this variable - often via registry modifications - an attacker can force Python to load libraries from an attacker-controlled directory instead of legitimate locations. This technique facilitates module hijacking, allowing the attacker to execute arbitrary code with the privileges of the user who invokes the Python interpreter. This activity is frequently observed in conjunction with the installation of malicious Python packages, serving as both a method for initial code execution and a persistent backdoor that activates automatically upon future Python sessions. Defenders should monitor registry modifications affecting environmental paths during package management workflows.

Attack Chain

1. Attacker delivers a malicious payload or script to the target system.
2. The target user or an automated process executes a Python package installation (e.g., via pip).
3. The installer triggers a process that interacts with the Windows environment configuration.
4. The malicious process or installer modifies the HKCU\Environment\PYTHONPATH registry key.
5. The attacker places a malicious Python module (e.g., a .py file) in the directory specified by the modified PYTHONPATH.
6. The victim executes a standard Python application or script.
7. The Python interpreter traverses the modified PYTHONPATH, prioritizes the malicious directory, and loads the attacker's module.
8. Malicious code within the hijacked module executes, providing the attacker with sustained, user-level persistence.

Impact

Successful exploitation allows for arbitrary code execution and persistent access to the target host. Because the persistence mechanism relies on the standard Python import lookup process, the attacker's code runs every time the user invokes Python, potentially leading to credential theft, data exfiltration, or further lateral movement within the network.

Recommendation

• Enable Sysmon Event ID 1 (Process Creation) and Event ID 13 (Registry Value Set) to monitor for unauthorized changes to the PYTHONPATH environment variable.
• Deploy the provided Sigma rule to detect registry modifications to the PYTHONPATH key performed by processes associated with Python package installation.
• Investigate any process modifying HKCU\Environment\PYTHONPATH if it originates from an unexpected parent process or is not part of a known, approved development workflow.