Elastic low stable eql

Python Path File (pth) Creation

This rule detects the creation of .pth files in system-wide and user-specific Python package directories, which can be abused for persistent code execution. .pth files automatically execute Python code when the interpreter starts, making them a stealthy persistence mechanism. Monitoring these paths helps identify unauthorized modifications that could indicate persistence by an attacker or malicious package injection.

View Source

Detection Logic

file where host.os.type == "linux" and event.action == "creation" and file.extension == "pth" and
file.path like (
  "/usr/local/lib/python*/dist-packages/*", 
  "/usr/lib/python*/dist-packages/*",
  "/usr/local/lib/python*/site-packages/*",
  "/usr/lib/python*/site-packages/*",
  "/home/*/.local/lib/python*/site-packages/*",
  "/opt/*/lib/python*/site-packages/*"
) and process.executable != null and not (
  process.executable in (
    "/usr/bin/restic", "/usr/bin/pacman", "/usr/bin/dockerd",  "/usr/bin/podman", "/usr/bin/pamac-daemon",
    "/usr/bin/dnf", "/usr/bin/dnf5", "/bin/dnf5", "/bin/podman", "./usr/bin/podman", "/kaniko/executor",
    "/dev/fd/3", "/opt/SolarWinds/Agent/bin/Plugins/Discovery/SolarWinds.Agent.Discovery.Plugin", "/usr/bin/crio",
    "/opt/splunk/bin/splunkd", "/opt/Tanium/TaniumClient/TaniumCX"
  ) or
  process.executable like (
    "/nix/store/*libexec/docker/dockerd", "/snap/docker/*dockerd"
  ) or
  (
    process.name like ("platform-python*", "cp", "uv") and
    file.name in ("distutils-precedence.pth", "_virtualenv.pth")
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...