Pth - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/pth/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jul 2024 12:00:00 +0000Python .pth File Creation for Persistencehttps://feed.craftedsignal.io/briefs/2024-07-python-pth-persistence/Wed, 03 Jul 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-07-python-pth-persistence/Attackers can establish persistence on Linux systems by creating malicious .pth files in Python package directories, causing arbitrary code execution on interpreter startup.Attackers can exploit Python's .pth file mechanism to achieve persistence on Linux systems. These files, placed in standard Python library directories, automatically execute arbitrary Python code when the interpreter starts. This technique allows for stealthy and persistent execution, bypassing traditional startup scripts or scheduled tasks. The Elastic detection rule identifies unauthorized creation of .pth files, excluding legitimate package managers and known benign processes. Volexity reported on CVE-2024-3400 which exploited this persistence technique in April 2024. This is relevant for defenders as it highlights a method for attackers to maintain access and execute malicious code within compromised environments, even after system reboots or updates.

Attack Chain

  1. Initial Access: An attacker gains initial access to a Linux system through an exploit (e.g., CVE-2024-3400) or compromised credentials.
  2. Privilege Escalation (Optional): The attacker may escalate privileges to gain write access to system-wide Python package directories like /usr/lib/python*/site-packages/.
  3. Malicious .pth Creation: The attacker creates a .pth file (e.g., evil.pth) within a Python package directory.
  4. Payload Injection: The .pth file contains a path to a malicious Python script or directly includes Python code to execute. This code may download and execute a secondary payload, establish a reverse shell, or perform other malicious actions.
  5. Interpreter Startup: When Python interpreter starts, it automatically executes the code specified in the .pth file.
  6. Persistent Execution: The malicious code executes every time Python interpreter is invoked, ensuring the attacker maintains persistent access to the system.
  7. Defense Evasion: The attacker may obfuscate the code within the .pth file or the linked script to evade detection.
  8. Goal: The attacker maintains persistent access to the compromised system for lateral movement, data exfiltration, or other malicious objectives.

Impact

Successful exploitation allows attackers to maintain persistent access to compromised Linux systems. The impact ranges from data theft and system disruption to complete system compromise. While no specific victim count is available, this technique can affect any organization relying on Python applications. The stealthy nature of .pth file-based persistence makes it difficult to detect, potentially leading to prolonged periods of undetected malicious activity.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect suspicious .pth file creation events in Python package directories.
  • Enable Elastic Defend integration to collect file creation events necessary for the provided Sigma rule.
  • Review and customize the exclusion list in the Sigma rule to account for legitimate package managers and automation processes within your environment.
  • Monitor system logs for unusual Python interpreter activity following .pth file creation events.
  • Investigate any alerts generated by the Sigma rule to determine the legitimacy of the .pth file creation and the code it executes.
  • Implement file integrity monitoring (FIM) on Python package directories to detect unauthorized modifications.
]]>mediumadvisorypersistencepythonlinuxpthfile_creation