{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/persistence-technique/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["TeamPCP"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","supply-chain-compromise","python","persistence-technique"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe threat actor group TeamPCP has been identified exploiting the Python interpreter's behavior regarding path configuration files (.pth). During the supply chain compromise of the 'litellm' package, the actors embedded malicious .pth files within the package distribution. When these packages are installed, the .pth file is placed into the site-packages or dist-packages directory. The Python interpreter automatically processes these files upon every subsequent invocation, leading to persistent, arbitrary code execution on the compromised host. This technique is particularly effective as it bypasses traditional execution controls and remains active regardless of how the Python application is built or distributed. Defenders should monitor for the correlation between Python process execution and the creation of .pth files in sensitive package directories.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe adversary publishes a malicious version of a legitimate Python package (e.g., 'litellm') to a public repository.\u003c/li\u003e\n\u003cli\u003eA target user installs the malicious package via 'pip' or other standard package managers.\u003c/li\u003e\n\u003cli\u003eThe malicious installation script triggers a process (e.g., python.exe) to handle package setup.\u003c/li\u003e\n\u003cli\u003eThe installation process writes a malicious .pth file to the target's 'site-packages' or 'dist-packages' directory.\u003c/li\u003e\n\u003cli\u003eThe attacker's code inside the .pth file is configured to execute upon Python startup.\u003c/li\u003e\n\u003cli\u003eThe victim executes a local Python script or application on the host.\u003c/li\u003e\n\u003cli\u003eThe Python interpreter automatically parses the directory, discovers the .pth file, and executes the contained malicious commands.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves persistence and potential full control over the compromised environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in persistent arbitrary code execution on the target endpoint. Any host that installs the compromised package, including developers and automated CI/CD build environments, becomes infected. This enables data exfiltration, lateral movement, and long-term access to the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon logging for Event ID 1 (Process Creation) and Event ID 11 (File Creation) to capture .pth file modifications.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the specific correlation between python.exe activity and .pth file creation.\u003c/li\u003e\n\u003cli\u003eReview the contents of any .pth files found in site-packages or dist-packages for suspicious imports or command execution scripts.\u003c/li\u003e\n\u003cli\u003eAudit Python environments for unauthorized changes to package installation directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T13:08:12Z","date_published":"2026-08-21T13:08:12Z","id":"https://feed.craftedsignal.io/briefs/2026-08-python-pth-persistence/","summary":"The threat actor TeamPCP leverages Python path configuration (.pth) files created during package installation to achieve persistent arbitrary code execution.","title":"TeamPCP Persistence via Malicious Python .pth Files","url":"https://feed.craftedsignal.io/briefs/2026-08-python-pth-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Persistence-Technique","version":"https://jsonfeed.org/version/1.1"}