huntrule

Linux Process Creation: Python Imports pty and Spawns a Pseudo-TTY

Flags Linux executions where Python imports the pty module and calls spawn to create a pseudo-TTY session.

FreeUnreviewedSigmamediumv1
title: "Linux Process Creation: Python Imports pty and Spawns a Pseudo-TTY"
id: dd86af87-6fc8-407a-9f90-256d618c5a9c
related:
  - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0
    type: similar
  - id: c4042d54-110d-45dd-a0e1-05c47822c937
    type: derived
status: test
description: This rule identifies Linux process executions where the image path suggests Python and the command line contains Python imports from the pty module followed by a call to spawn. Attackers may use PTY-based spawning to create interactive-looking terminal sessions, which can support reverse shells and command-and-control tooling. Telemetry relies on process creation records capturing the executable path and the full command line, including the presence of "import pty" or "from pty" and subsequent "spawn" usage.
references:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-03
modified: 2024-11-04
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    - Image|endswith:
        - /python
        - /python2
        - /python3
    - Image|contains:
        - /python2.
        - /python3.
  selection_cli_import:
    CommandLine|contains:
      - import pty
      - "from pty "
  selection_cli_spawn:
    CommandLine|contains: spawn
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies Linux process executions where the image path suggests Python and the command line contains Python imports from the pty module followed by a call to spawn. Attackers may use PTY-based spawning to create interactive-looking terminal sessions, which can support reverse shells and command-and-control tooling. Telemetry relies on process creation records capturing the executable path and the full command line, including the presence of "import pty" or "from pty" and subsequent "spawn" usage.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.