Attack Chain

1. The adversary publishes a malicious version of a legitimate Python package (e.g., 'litellm') to a public repository.
2. A target user installs the malicious package via 'pip' or other standard package managers.
3. The malicious installation script triggers a process (e.g., python.exe) to handle package setup.
4. The installation process writes a malicious .pth file to the target's 'site-packages' or 'dist-packages' directory.
5. The attacker's code inside the .pth file is configured to execute upon Python startup.
6. The victim executes a local Python script or application on the host.
7. The Python interpreter automatically parses the directory, discovers the .pth file, and executes the contained malicious commands.
8. The attacker achieves persistence and potential full control over the compromised environment.

Impact

Successful exploitation results in persistent arbitrary code execution on the target endpoint. Any host that installs the compromised package, including developers and automated CI/CD build environments, becomes infected. This enables data exfiltration, lateral movement, and long-term access to the internal network.

Recommendation

• Enable Sysmon logging for Event ID 1 (Process Creation) and Event ID 11 (File Creation) to capture .pth file modifications.
• Deploy the provided Sigma rule to detect the specific correlation between python.exe activity and .pth file creation.
• Review the contents of any .pth files found in site-packages or dist-packages for suspicious imports or command execution scripts.
• Audit Python environments for unauthorized changes to package installation directories.