PyTorch - CraftedSignal Threat Feed

First Time Python Created a LaunchAgent or LaunchDaemon

hello@craftedsignal.io — Wed, 03 Jul 2024 14:27:00 +0000

This alert focuses on detecting suspicious persistence mechanisms on macOS systems where a Python process is observed creating or modifying LaunchAgent or LaunchDaemon plist files for the first time. Attackers achieving Python code execution, whether through malicious scripts, compromised dependencies, or model file deserialization vulnerabilities such as pickle or PyTorch __reduce__, may drop plist files to establish persistence. These LaunchAgents and LaunchDaemons are designed to configure programs to run automatically at login or boot, ensuring the attacker's payload survives reboots and user logouts. This activity is often a strong indicator of compromise because legitimate Python processes rarely need to create persistence mechanisms.

Attack Chain

Initial Access: The attacker gains initial access to the macOS system through various means, such as exploiting a vulnerability in an application, social engineering, or phishing.
Code Execution: Once inside, the attacker achieves code execution, often leveraging Python through malicious scripts, compromised dependencies (e.g., via pip), or model file deserialization.
Persistence Preparation: The attacker crafts a malicious LaunchAgent or LaunchDaemon plist file. This file contains configurations to automatically run a specified program at login or boot.
File Creation/Modification: The malicious Python script creates or modifies a plist file in either /Library/LaunchAgents/, ~/Library/LaunchAgents/, or /Library/LaunchDaemons/.
Persistence Installation: The system recognizes the new or modified plist file and schedules the specified program to run automatically.
Payload Execution: At the next login or boot, the system executes the program specified in the plist file, initiating the attacker's payload.
Command and Control: The executed payload establishes a connection to a command-and-control server, allowing the attacker to remotely control the compromised system.

Impact

Successful exploitation could lead to persistent access to the compromised macOS system, enabling attackers to maintain their foothold even after reboots or user logouts. This can lead to data theft, installation of malware, or further lateral movement within the network. The impact extends to potential data breaches, system compromise, and reputational damage. While the specific number of victims is unknown, the threat affects any macOS system susceptible to malicious Python scripts or compromised dependencies.

Recommendation

Enable Sysmon process-creation and file-creation logging to capture the events required for the rules below (references "process_creation" and "file_event" log sources).
Deploy the Sigma rule "macOS Suspicious LaunchAgent/Daemon Creation by Python" to your SIEM and tune for your environment to detect the behavior (references the Sigma rule).
Investigate any persistence events involving Python creating LaunchDaemons by reviewing persistence event fields such as Persistence.runatload, Persistence.keepalive, Persistence.args, Persistence.path to understand the plist configuration.

First Time Python Accessed Sensitive Credential Files on macOS

hello@craftedsignal.io — Wed, 03 Jul 2024 12:00:00 +0000

This detection rule identifies instances where a Python process accesses sensitive credential files on macOS for the first time. This activity is often indicative of post-exploitation credential theft, where attackers leverage Python code execution (through malicious scripts, compromised dependencies, or model file deserialization) to target sensitive data. Since legitimate Python processes rarely interact with files containing SSH keys, cloud provider credentials, browser session cookies, Kerberos tickets, or keychain databases, such access is considered a high-confidence indicator of compromise. The rule specifically focuses on "first occurrence" events within a 7-day window to minimize noise from legitimate but infrequent access patterns. This alert is designed to detect malicious activity related to Python-based attacks targeting credential stores on macOS systems.

Attack Chain

Initial Access: Attacker gains initial access to the macOS system through a software vulnerability or social engineering.
Code Execution: The attacker executes malicious Python code on the compromised system. This could be through a malicious script, a compromised dependency, or exploitation of unsafe deserialization practices like pickle/PyTorch __reduce__.
Discovery: The Python script enumerates potential credential file locations on the system.
Credential Access: The Python script attempts to open and read sensitive files such as SSH keys (~/.ssh/id_rsa), AWS credentials (~/.aws/credentials), browser cookies, Kerberos tickets (/tmp/krb5cc_*), or macOS keychain databases (~/Library/Keychains/login.keychain-db).
Data Collection: The stolen credentials are saved to a temporary file or memory.
Exfiltration: The attacker establishes a network connection to an external server and exfiltrates the collected credential data.
Lateral Movement/Privilege Escalation: The attacker uses the stolen credentials to move laterally to other systems or escalate privileges within the network.

Impact

A successful attack can lead to unauthorized access to sensitive data, lateral movement within the network, and potential privilege escalation. If SSH keys are compromised, attackers can gain access to other systems without authentication. Compromised AWS credentials can lead to unauthorized access to cloud resources, potentially resulting in data breaches and financial losses. Browser cookie theft allows attackers to hijack user sessions, gaining access to web applications and services.

Recommendation

Deploy the Sigma rule macOS Python Credential File Access to your SIEM and tune for your environment, ensuring it is enabled and actively monitoring file access events.
Enable Elastic Defend endpoint file monitoring to capture open events for sensitive credential files, as required by the rule macOS Python Credential File Access.
Implement weights_only=True enforcement for PyTorch model loading to mitigate risks associated with malicious model files, as mentioned in the overview.
Investigate and quarantine any Python processes flagged by the Sigma rule macOS Python Credential File Access to prevent further data exfiltration or lateral movement.
Rotate any compromised credentials (SSH keys, AWS access keys, cloud tokens) identified during incident response, as described in the Triage section.
Monitor process command lines for suspicious arguments or script execution related to credential access using the Sigma rule Suspicious Python Script Execution.

First Time Python Spawned a Shell on macOS Host

hello@craftedsignal.io — Tue, 02 Jul 2024 12:00:00 +0000

This detection identifies the initial instance of a Python process spawning a shell on a macOS host. Attackers often leverage Python code execution, gained through malicious scripts, compromised dependencies, or insecure model file deserialization (e.g., pickle/PyTorch __reduce__), to spawn shell processes. These shell processes are then used for reconnaissance, credential theft, persistence, or establishing reverse shells. The rule specifically looks for shell invocations using the -c flag, which is often used to execute commands directly within the shell. Given that legitimate Python workflows typically avoid using -c to execute shell commands, the first appearance of such behavior on a host is a significant indicator of a potential compromise. The rule leverages a 7-day window to establish the first occurrence baseline.

Attack Chain

Attacker gains initial access to a macOS system via methods such as phishing or exploiting a vulnerable service.
Attacker uploads or introduces a malicious Python script or compromises an existing Python dependency.
The malicious Python script is executed. This could occur via a user executing the script, a cron job, or a compromised application loading the script.
The Python script uses the subprocess module or a similar function to spawn a shell process (e.g., bash, sh, zsh) with the -c flag.
The shell executes a command provided by the Python script, such as system reconnaissance (whoami, ifconfig), credential access (security dump-keychain), or persistence mechanisms.
The attacker may establish a reverse shell to maintain access to the compromised system.
The attacker performs lateral movement or exfiltrates sensitive data.

Impact

Successful exploitation can lead to a wide range of consequences, including unauthorized access to sensitive data, system compromise, and lateral movement within the network. While specific victim counts or sectors targeted are not provided, the attack could impact any macOS environment where Python is used, particularly those handling sensitive information or running custom Python scripts.

Recommendation

Deploy the Sigma rule Python Shell Spawned with -c to your SIEM to detect the behavior described in this brief and tune for your environment.
Enable Sysmon process creation logging to ensure the process_creation log category is populated, allowing for accurate detection using the provided Sigma rules.
Investigate any alerts generated by the Sigma rule, focusing on the parent Python process and the executed shell command to understand the context of the activity.
Implement weights_only=True enforcement for PyTorch model loading across the environment, as referenced in the "https://blog.trailofbits.com/2024/06/11/exploiting-ml-models-with-pickle-file-attacks-part-1/" reference.