splunk · onurmerdogan · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 18, 2026
@@ -0,0 +1,112 @@
+name: Python Network Traffic During Package Build
+id: 03c9c504-2294-44da-8180-beefe1ca8ba8
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects a Python process making an outbound network connection during package installation.
+    Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
+    This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
+    If confirmed malicious, this could indicate a successful software supply chain compromise.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 3
+search: |-
+    `sysmon`
+    (
+        EventID=1
+        (
+            process="*_in_process.py*"
+            OR
+            process_name=python.exe
+        )
+    )
+    OR
+    (
+        EventID=3
+        dest_ip!=""
+        process_name=python.exe
+    )
+
+    | eval dest=if(EventID=3, Computer, dest)
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(dest_ip) as dest_ip
+                  values(dest_host) as dest_host
+
+      by dest source process_id
+
+    | search process="* build_wheel*"
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            dest_ip dest_host
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_network_traffic_during_package_build_filter`
+how_to_implement: |-
+    The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs
+    with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate
+    Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.
+known_false_positives: |-
+    Python packages may contact software repositories, mirror sites during build time.
+    Investigate the destination and package content to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A Python process [$process$] on [$dest$] made an outbound network connection to [$dest_ip$] with hostname [$dest_host$] during package installation.
+threat_objects:
+    - field: process
+      type: process
+    - field: dest_ip
+      type: ip_address
+    - field: dest_host
+      type: domain
+analytic_story:
+    - Malicious Python Package Installation
+    - Ingress Tool Transfer
+    - Command And Control
+    - Compromised Windows Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1195.002
+    - T1059.006
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
@@ -0,0 +1,106 @@
+name: Python PTH File Creation During Package Installation
+id: bf581b86-39cd-48b7-9312-d9affb48a8bc
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
+    Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
+    This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 11
+search: |-
+    `sysmon`
+    EventID IN (1,11)
+    process_name="python.exe"
+    (
+        process="* install *"
+        OR
+        (
+            file_name="*.pth"
+            action="created"
+        )
+    )
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(file_name) as file_name
+                  values(file_path) as file_path
+                  dc(EventID) as dc_event_id
+
+      by dest source process_id
+
+    | search dc_event_id>1 AND process!="*-- setuptools*"
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            file_name file_path
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_pth_file_creation_during_package_installation_filter`
+how_to_implement: |-
+    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+    and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth
+    extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
+    Splunk Common Information Model (CIM).
+known_false_positives: |-
+    Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
+    Investigate the file contents and parent process to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 30
+          message: A Python .pth file called [$file_name$] located at [$file_path$] was created on [$dest$] during package installation using [$process$].
+threat_objects:
+    - field: process
+      type: process
+    - field: file_name
+      type: file_name
+    - field: file_path
+      type: file_path
+analytic_story:
+    - Malicious Python Package Installation
+    - Compromised Windows Host
+    - Windows Persistence Techniques
+asset_type: Endpoint
+mitre_attack_id:
+    - T1546
+    - T1195.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
@@ -0,0 +1,106 @@
+name: Python PYTHONPATH Modification During Package Installation
+id: 00f01ba4-df01-4caa-90f6-187e4563a516
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
+    Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
+    If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 13
+search: |-
+    `sysmon`
+    EventID IN (1,13)
+    (
+        parent_process="*\\site-packages\\pip\\*"
+        OR
+        (
+            registry_path="*PYTHONPATH"
+            action="modified"
+        )
+    )
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(registry_path) as registry_path
+                  values(registry_value_data) as registry_value_data
+                  dc(EventID) as dc_event_id
+
+      by dest source process_id
+
+    | search dc_event_id>1
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            registry_path registry_value_data
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_pythonpath_modification_during_package_installation_filter`
+how_to_implement: |-
+    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+    and registry modification (EventID 13) events, ensuring that registry modification events are collected for the
+    PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on
+    and normalize field names using the Splunk Common Information Model (CIM).
+known_false_positives: |-
+    Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
+    Investigate the new value and parent process to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$].
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: process
+      type: process
+    - field: registry_value_data
+      type: registry_value_data
+analytic_story:
+    - Malicious Python Package Installation
+    - Compromised Windows Host
+    - Windows Persistence Techniques
+    - Suspicious Windows Registry Activities
+    - Windows Registry Abuse
+asset_type: Endpoint
+mitre_attack_id:
+    - T1574.007
+    - T1195.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit