Elastic low stable eql

Python Site or User Customize File Creation

This rule detects the creation and modification of sitecustomize.py and usercustomize.py, which Python automatically executes on startup. Attackers can exploit these files for persistence by injecting malicious code. The rule monitors system-wide, user-specific, and virtual environment locations to catch unauthorized changes that could indicate persistence or backdooring attempts.

View Source

Detection Logic

file where host.os.type == "linux" and event.type == "creation" and process.executable != null and
file.path like (
  "/usr/lib/python*/sitecustomize.py",
  "/usr/local/lib/python*/sitecustomize.py",
  "/usr/lib/python*/dist-packages/sitecustomize.py",
  "/usr/local/lib/python*/dist-packages/sitecustomize.py",
  "/opt/*/lib/python*/sitecustomize.py",
  "/home/*/.local/lib/python*/site-packages/usercustomize.py",
  "/home/*/.config/python/usercustomize.py"
) and not (
  process.executable in (
    "/usr/bin/restic", "/usr/bin/pacman", "/usr/bin/dockerd", "/usr/bin/podman", "/usr/bin/pamac-daemon",
    "./usr/bin/podman", "/opt/miniforge3/bin/mamba", "/usr/sbin/dockerd", "/opt/conda/_conda", "/kaniko/executor",
    "/usr/bin/crio", "/usr/lib/systemd/systemd-executor"
  ) or
  process.executable like~ ("/nix/store/*libexec/docker/dockerd", "/snap/docker/*dockerd")
)

Field Validations

Loading…

Comments (0)

Loading comments...