Abuse of Python Site-Package Hooks for Persistence

Adversaries are leveraging Python site initialization hooks to establish persistence on compromised Windows, Linux, and macOS endpoints. By planting a 'sitecustomize.py' or 'usercustomize.py' script within 'site-packages' or 'dist-packages' directories, an attacker ensures their malicious code is automatically executed every time the Python interpreter starts. This technique, notably used by the VIPERTUNNEL backdoor to trigger subsequent DLL-based payloads, effectively hides malicious logic within the standard Python environment. Defenders should focus on monitoring for the creation of these specific files in conjunction with software installation processes, as this behavior often indicates a supply chain compromise or the final stage of a malware deployment.

Attack Chain

1. Attacker identifies a target system with existing Python environments and accessible site-packages or dist-packages directories.
2. Attacker initiates a malicious installation process or abuses legitimate package managers to gain execution context.
3. Attacker writes a malicious script named 'sitecustomize.py' or 'usercustomize.py' to a directory included in the Python 'sys.path'.
4. The malicious hook script contains logic to import malicious libraries or execute shell commands.
5. The attacker completes the package installation or masquerades as a legitimate installation to evade initial detection.
6. A user or system process subsequently invokes the Python interpreter for normal operations.
7. The Python 'site' module automatically detects and executes the planted hook file during initialization.
8. The malicious payload executes in the security context of the user or service running the Python process, achieving persistence.

Impact

This technique enables persistent arbitrary code execution with the permissions of the invoking Python process. Depending on the target environment, this could lead to full system compromise, data exfiltration, or lateral movement. It has been observed in the wild supporting the VIPERTUNNEL backdoor, which uses this persistence mechanism to facilitate further stages of an attack.

Recommendation

• Enable Sysmon or equivalent endpoint logging for both process creation (Event ID 1) and file creation (Event ID 11).
• Deploy the provided Sigma rule to monitor the creation of 'sitecustomize.py' or 'usercustomize.py' files during package installation events.
• Investigate any detected files by inspecting the file contents and the parent process that performed the write operation to distinguish between legitimate environment configuration and malicious activity.