{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/script-based-execution/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["execution","script-based-execution","python","linux","macos"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis detection rule focuses on identifying suspicious activity on Linux and macOS systems where a Python interpreter initiates a rapid sequence of shell commands. Attackers frequently leverage Python to execute shell commands (e.g., \u003ccode\u003esh -c\u003c/code\u003e) as part of a post-exploitation workflow. This allows them to profile the compromised host, locate sensitive data, pull down additional malicious payloads via \u003ccode\u003ecurl\u003c/code\u003e or \u003ccode\u003ewget\u003c/code\u003e, and facilitate lateral movement or persistence.\u003c/p\u003e\n\u003cp\u003eThe core indicator is the rapid execution of at least five distinct command lines containing at least four unique command patterns (such as environment enumeration, discovery utilities, or network tools) within a single one-minute window. This behavior is indicative of automated scripting used by a backdoor rather than standard administrative or application-level behavior. Defenders should focus on Python-led process trees that diverge from approved deployment or maintenance workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial execution on a Linux or macOS host, often through a web shell or a malicious script.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a Python-based backdoor or script to facilitate hands-on-keyboard activity.\u003c/li\u003e\n\u003cli\u003eThe Python process begins profiling the host environment by spawning child shell processes (e.g., \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003esh\u003c/code\u003e, \u003ccode\u003ezsh\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe shell child processes execute discovery commands such as \u003ccode\u003ewhoami\u003c/code\u003e, \u003ccode\u003euname\u003c/code\u003e, and \u003ccode\u003ehostname\u003c/code\u003e via \u003ccode\u003esh -c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe script iterates through system configuration or environment variables using commands like \u003ccode\u003eenv\u003c/code\u003e or \u003ccode\u003efind\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the shell child processes to invoke \u003ccode\u003ecurl\u003c/code\u003e or \u003ccode\u003ewget\u003c/code\u003e to retrieve follow-on payloads from external C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eThe script attempts to access sensitive files or modify system configurations to achieve persistence.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved, such as credential theft, data exfiltration, or establishing a recurring command-and-control connection.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain full visibility into the host environment, extract credentials, and move laterally across the network. If left undetected, this activity leads to significant data breaches, unauthorized access to sensitive application secrets, and potential long-term persistence within the organization's infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the implementation of process-creation telemetry to monitor for anomalous shell command patterns initiated by Python.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule logic to your SIEM to monitor for Python processes spawning high volumes of shell children.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering to block unauthorized connections from Python or shell interpreters to known untrusted infrastructure.\u003c/li\u003e\n\u003cli\u003eAudit all Python execution paths in temporary directories and restrict the ability of service accounts to spawn shell interpreters.\u003c/li\u003e\n\u003cli\u003eInvestigate any occurrences flagged by the detection logic to confirm whether they originate from approved administrative scripts or unauthorized malicious payloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:17:52Z","date_published":"2026-09-18T19:17:52Z","id":"https://feed.craftedsignal.io/briefs/2026-09-suspicious-python-shell-execution/","summary":"This detection logic identifies potentially malicious activity where a Python process rapidly spawns multiple shell commands via '-c' arguments for host profiling, discovery, or lateral movement.","title":"Suspicious Python Shell Command Execution","url":"https://feed.craftedsignal.io/briefs/2026-09-suspicious-python-shell-execution/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","python","script-based-execution","obfuscation"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries are increasingly employing simple substitution ciphers, specifically the ROT cipher, to obfuscate Python scripts embedded within software packages. This technique is designed to hinder static analysis by security researchers and automated tools. When the Python interpreter loads these obfuscated components, the code is often decoded or deobfuscated in memory, providing an execution path for malicious activity.\u003c/p\u003e\n\u003cp\u003eThis threat is particularly relevant to developer environments where third-party Python packages are frequently installed. By masking malicious functionality as legitimate library components, attackers increase the likelihood that the code will be executed within a trusted development context. Security operations teams should focus on identifying instances where the Python interpreter interacts with compiled bytecode files featuring specific naming patterns indicative of ROT-based obfuscation, particularly those following the 'rot_??.cpython-*.pyc' nomenclature.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to execute malicious code on developer endpoints and CI/CD pipelines under the guise of legitimate Python packages. This can lead to credential theft, intellectual property exfiltration, or the establishment of persistent backdoors in internal build environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDetection engineering teams should monitor for the execution of Python processes that concurrently access files matching known obfuscation patterns.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for Python processes interacting with files following the 'rot_??.cpython-*.pyc' naming convention.\u003c/li\u003e\n\u003cli\u003eEstablish baseline behavior for Python execution in development environments to facilitate the identification of anomalous library loading.\u003c/li\u003e\n\u003cli\u003eImplement strict application control or allowlisting for packages utilized in production environments to minimize the risk of executing unauthorized code.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:09:46Z","date_published":"2026-09-18T19:09:46Z","id":"https://feed.craftedsignal.io/briefs/2026-09-rot-obfuscated-python/","summary":"Adversaries utilize ROT-encoded Python scripts within packages to obfuscate malicious logic and evade security analysis on Windows and macOS systems.","title":"Detection of ROT-Encoded Python Script Execution","url":"https://feed.craftedsignal.io/briefs/2026-09-rot-obfuscated-python/"}],"language":"en","title":"CraftedSignal Threat Feed - Script-Based-Execution","version":"https://jsonfeed.org/version/1.1"}