macOS Python .pth File Creation in site-packages Path

title: macOS Python .pth File Creation in site-packages Path
id: c310d9f5-f389-448d-9a5f-028968f0814a
related:
  - id: e3652ba3-0ad8-4010-a957-b7ba369e7bac
    type: similar
  - id: fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce
    type: similar
  - id: 4f394635-13ef-4599-b677-3353e0f84f55
    type: derived
status: test
description: This rule flags the creation of Python path configuration files (.pth) within macOS Python site-packages directories. Attackers can abuse .pth files because the referenced code is executed at Python startup (v3.5+), enabling execution and potential persistence. It relies on file event telemetry that includes the full target filename for newly created files and matches .pth files located under /lib/python3.X/site-packages.
references:
  - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
  - https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
  - https://docs.python.org/3/library/site.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/macos/file/file_event/file_event_macos_python_path_configuration_files.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-04-25
tags:
  - attack.execution
  - attack.t1059.006
  - detection.threat-hunting
logsource:
  product: macos
  category: file_event
detection:
  selection:
    TargetFilename|re: (?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/
    TargetFilename|endswith: .pth
  condition: selection
falsepositives:
  - Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.
level: medium
license: DRL-1.1