huntrule

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

FreeUnreviewedSigmahighv1
title: Python Process Spawning a Pretty TTY via pty.spawn on Windows
id: 1ad8f865-a3da-4781-9e3c-1c4475347826
related:
  - id: 899133d5-4d7c-4a7f-94ee-27355c879d90
    type: derived
  - id: 480e7e51-e797-47e3-8d72-ebfce65b6d8d
    type: derived
status: test
description: This rule identifies Windows process creation events where python.exe (or python2/python3) is invoked with code importing and calling pty spawning functionality (e.g., importing pty and using spawn). Attackers may leverage pseudo-terminal behavior to improve interactive command execution, stealth, or terminal handling during exploitation. It relies on Windows process creation telemetry, matching the executable name and specific Python command-line patterns associated with pty usage.
references:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-03
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - python.exe
      - python3.exe
      - python2.exe
  selection_cli_1:
    CommandLine|contains|all:
      - import pty
      - .spawn(
  selection_cli_2:
    CommandLine|contains: from pty import spawn
  condition: selection_img and 1 of selection_cli_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process creation events where python.exe (or python2/python3) is invoked with code importing and calling pty spawning functionality (e.g., importing pty and using spawn). Attackers may leverage pseudo-terminal behavior to improve interactive command execution, stealth, or terminal handling during exploitation. It relies on Windows process creation telemetry, matching the executable name and specific Python command-line patterns associated with pty usage.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.