{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/pytorch/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["macOS","Python","PyTorch"],"_cs_severities":["medium"],"_cs_tags":["persistence","macos","python","launchagent","launchdaemon"],"_cs_type":"advisory","_cs_vendors":["Apple","Python Software Foundation","Meta Platforms"],"content_html":"\u003cp\u003eThis alert focuses on detecting suspicious persistence mechanisms on macOS systems where a Python process is observed creating or modifying LaunchAgent or LaunchDaemon plist files for the first time. Attackers achieving Python code execution, whether through malicious scripts, compromised dependencies, or model file deserialization vulnerabilities such as pickle or PyTorch \u003ccode\u003e__reduce__\u003c/code\u003e, may drop plist files to establish persistence. These LaunchAgents and LaunchDaemons are designed to configure programs to run automatically at login or boot, ensuring the attacker's payload survives reboots and user logouts. This activity is often a strong indicator of compromise because legitimate Python processes rarely need to create persistence mechanisms.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: The attacker gains initial access to the macOS system through various means, such as exploiting a vulnerability in an application, social engineering, or phishing.\u003c/li\u003e\n\u003cli\u003eCode Execution: Once inside, the attacker achieves code execution, often leveraging Python through malicious scripts, compromised dependencies (e.g., via pip), or model file deserialization.\u003c/li\u003e\n\u003cli\u003ePersistence Preparation: The attacker crafts a malicious LaunchAgent or LaunchDaemon plist file.  This file contains configurations to automatically run a specified program at login or boot.\u003c/li\u003e\n\u003cli\u003eFile Creation/Modification: The malicious Python script creates or modifies a plist file in either \u003ccode\u003e/Library/LaunchAgents/\u003c/code\u003e, \u003ccode\u003e~/Library/LaunchAgents/\u003c/code\u003e, or \u003ccode\u003e/Library/LaunchDaemons/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePersistence Installation: The system recognizes the new or modified plist file and schedules the specified program to run automatically.\u003c/li\u003e\n\u003cli\u003ePayload Execution:  At the next login or boot, the system executes the program specified in the plist file, initiating the attacker's payload.\u003c/li\u003e\n\u003cli\u003eCommand and Control: The executed payload establishes a connection to a command-and-control server, allowing the attacker to remotely control the compromised system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could lead to persistent access to the compromised macOS system, enabling attackers to maintain their foothold even after reboots or user logouts. This can lead to data theft, installation of malware, or further lateral movement within the network. The impact extends to potential data breaches, system compromise, and reputational damage. While the specific number of victims is unknown, the threat affects any macOS system susceptible to malicious Python scripts or compromised dependencies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon process-creation and file-creation logging to capture the events required for the rules below (references \u0026quot;process_creation\u0026quot; and \u0026quot;file_event\u0026quot; log sources).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;macOS Suspicious LaunchAgent/Daemon Creation by Python\u0026quot; to your SIEM and tune for your environment to detect the behavior (references the Sigma rule).\u003c/li\u003e\n\u003cli\u003eInvestigate any persistence events involving Python creating LaunchDaemons by reviewing persistence event fields such as \u003ccode\u003ePersistence.runatload\u003c/code\u003e, \u003ccode\u003ePersistence.keepalive\u003c/code\u003e, \u003ccode\u003ePersistence.args\u003c/code\u003e, \u003ccode\u003ePersistence.path\u003c/code\u003e to understand the plist configuration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-07-03T14:27:00Z","date_published":"2024-07-03T14:27:00Z","id":"https://feed.craftedsignal.io/briefs/2024-07-macos-python-launchagent/","summary":"Detection of the first-time a Python process creates or modifies a LaunchAgent or LaunchDaemon plist file on a given macOS host, which is indicative of persistence attempts via malicious scripts, compromised dependencies, or model file deserialization.","title":"First Time Python Created a LaunchAgent or LaunchDaemon","url":"https://feed.craftedsignal.io/briefs/2024-07-macos-python-launchagent/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Python","PyTorch"],"_cs_severities":["medium"],"_cs_tags":["credential-access","python","macos","endpoint"],"_cs_type":"advisory","_cs_vendors":["Python","PyTorch"],"content_html":"\u003cp\u003eThis detection rule identifies instances where a Python process accesses sensitive credential files on macOS for the first time. This activity is often indicative of post-exploitation credential theft, where attackers leverage Python code execution (through malicious scripts, compromised dependencies, or model file deserialization) to target sensitive data. Since legitimate Python processes rarely interact with files containing SSH keys, cloud provider credentials, browser session cookies, Kerberos tickets, or keychain databases, such access is considered a high-confidence indicator of compromise. The rule specifically focuses on \u0026quot;first occurrence\u0026quot; events within a 7-day window to minimize noise from legitimate but infrequent access patterns. This alert is designed to detect malicious activity related to Python-based attacks targeting credential stores on macOS systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: Attacker gains initial access to the macOS system through a software vulnerability or social engineering.\u003c/li\u003e\n\u003cli\u003eCode Execution: The attacker executes malicious Python code on the compromised system. This could be through a malicious script, a compromised dependency, or exploitation of unsafe deserialization practices like pickle/PyTorch \u003ccode\u003e__reduce__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDiscovery: The Python script enumerates potential credential file locations on the system.\u003c/li\u003e\n\u003cli\u003eCredential Access: The Python script attempts to open and read sensitive files such as SSH keys (\u003ccode\u003e~/.ssh/id_rsa\u003c/code\u003e), AWS credentials (\u003ccode\u003e~/.aws/credentials\u003c/code\u003e), browser cookies, Kerberos tickets (\u003ccode\u003e/tmp/krb5cc_*\u003c/code\u003e), or macOS keychain databases (\u003ccode\u003e~/Library/Keychains/login.keychain-db\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eData Collection: The stolen credentials are saved to a temporary file or memory.\u003c/li\u003e\n\u003cli\u003eExfiltration: The attacker establishes a network connection to an external server and exfiltrates the collected credential data.\u003c/li\u003e\n\u003cli\u003eLateral Movement/Privilege Escalation: The attacker uses the stolen credentials to move laterally to other systems or escalate privileges within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack can lead to unauthorized access to sensitive data, lateral movement within the network, and potential privilege escalation. If SSH keys are compromised, attackers can gain access to other systems without authentication. Compromised AWS credentials can lead to unauthorized access to cloud resources, potentially resulting in data breaches and financial losses. Browser cookie theft allows attackers to hijack user sessions, gaining access to web applications and services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003emacOS Python Credential File Access\u003c/code\u003e to your SIEM and tune for your environment, ensuring it is enabled and actively monitoring file access events.\u003c/li\u003e\n\u003cli\u003eEnable Elastic Defend endpoint file monitoring to capture \u003ccode\u003eopen\u003c/code\u003e events for sensitive credential files, as required by the rule \u003ccode\u003emacOS Python Credential File Access\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement \u003ccode\u003eweights_only=True\u003c/code\u003e enforcement for PyTorch model loading to mitigate risks associated with malicious model files, as mentioned in the overview.\u003c/li\u003e\n\u003cli\u003eInvestigate and quarantine any Python processes flagged by the Sigma rule \u003ccode\u003emacOS Python Credential File Access\u003c/code\u003e to prevent further data exfiltration or lateral movement.\u003c/li\u003e\n\u003cli\u003eRotate any compromised credentials (SSH keys, AWS access keys, cloud tokens) identified during incident response, as described in the Triage section.\u003c/li\u003e\n\u003cli\u003eMonitor process command lines for suspicious arguments or script execution related to credential access using the Sigma rule \u003ccode\u003eSuspicious Python Script Execution\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-07-03T12:00:00Z","date_published":"2024-07-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-07-python-credential-access/","summary":"This alert triggers on the first instance of a Python process accessing sensitive credential files on macOS, potentially indicating post-exploitation credential theft.","title":"First Time Python Accessed Sensitive Credential Files on macOS","url":"https://feed.craftedsignal.io/briefs/2024-07-python-credential-access/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["macOS","Python","PyTorch"],"_cs_severities":["medium"],"_cs_tags":["execution","macos","python"],"_cs_type":"advisory","_cs_vendors":["Apple","Python Software Foundation","PyTorch Foundation"],"content_html":"\u003cp\u003eThis detection identifies the initial instance of a Python process spawning a shell on a macOS host. Attackers often leverage Python code execution, gained through malicious scripts, compromised dependencies, or insecure model file deserialization (e.g., pickle/PyTorch \u003ccode\u003e__reduce__\u003c/code\u003e), to spawn shell processes. These shell processes are then used for reconnaissance, credential theft, persistence, or establishing reverse shells. The rule specifically looks for shell invocations using the \u003ccode\u003e-c\u003c/code\u003e flag, which is often used to execute commands directly within the shell. Given that legitimate Python workflows typically avoid using \u003ccode\u003e-c\u003c/code\u003e to execute shell commands, the first appearance of such behavior on a host is a significant indicator of a potential compromise. The rule leverages a 7-day window to establish the first occurrence baseline.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a macOS system via methods such as phishing or exploiting a vulnerable service.\u003c/li\u003e\n\u003cli\u003eAttacker uploads or introduces a malicious Python script or compromises an existing Python dependency.\u003c/li\u003e\n\u003cli\u003eThe malicious Python script is executed. This could occur via a user executing the script, a cron job, or a compromised application loading the script.\u003c/li\u003e\n\u003cli\u003eThe Python script uses the \u003ccode\u003esubprocess\u003c/code\u003e module or a similar function to spawn a shell process (e.g., bash, sh, zsh) with the \u003ccode\u003e-c\u003c/code\u003e flag.\u003c/li\u003e\n\u003cli\u003eThe shell executes a command provided by the Python script, such as system reconnaissance (\u003ccode\u003ewhoami\u003c/code\u003e, \u003ccode\u003eifconfig\u003c/code\u003e), credential access (\u003ccode\u003esecurity dump-keychain\u003c/code\u003e), or persistence mechanisms.\u003c/li\u003e\n\u003cli\u003eThe attacker may establish a reverse shell to maintain access to the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker performs lateral movement or exfiltrates sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to a wide range of consequences, including unauthorized access to sensitive data, system compromise, and lateral movement within the network. While specific victim counts or sectors targeted are not provided, the attack could impact any macOS environment where Python is used, particularly those handling sensitive information or running custom Python scripts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003ePython Shell Spawned with -c\u003c/code\u003e to your SIEM to detect the behavior described in this brief and tune for your environment.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process creation logging to ensure the \u003ccode\u003eprocess_creation\u003c/code\u003e log category is populated, allowing for accurate detection using the provided Sigma rules.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the parent Python process and the executed shell command to understand the context of the activity.\u003c/li\u003e\n\u003cli\u003eImplement \u003ccode\u003eweights_only=True\u003c/code\u003e enforcement for PyTorch model loading across the environment, as referenced in the \u0026quot;https://blog.trailofbits.com/2024/06/11/exploiting-ml-models-with-pickle-file-attacks-part-1/\u0026quot; reference.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-07-02T12:00:00Z","date_published":"2024-07-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-07-python-shell-macos/","summary":"This rule detects the first time a Python process spawns a shell on a given macOS host using the `-c` flag, indicating potential malicious activity stemming from compromised Python environments.","title":"First Time Python Spawned a Shell on macOS Host","url":"https://feed.craftedsignal.io/briefs/2024-07-python-shell-macos/"}],"language":"en","title":"CraftedSignal Threat Feed - PyTorch","version":"https://jsonfeed.org/version/1.1"}