Python Process Spawning a Pretty TTY via pty.spawn on Windows
Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.
- Product
- windows
- Category
- process_creation
- Author
- Nextron Systems (SigmaHQ), DRL 1.1
- Published
- 2022-06-03
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where python.exe (or python2/python3) is invoked with code importing and calling pty spawning functionality (e.g., importing pty and using spawn). Attackers may leverage pseudo-terminal behavior to improve interactive command execution, stealth, or terminal handling during exploitation. It relies on Windows process creation telemetry, matching the executable name and specific Python command-line patterns associated with pty usage.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Python Process Spawning a Pretty TTY via pty.spawn on Windows
id: 1ad8f865-a3da-4781-9e3c-1c4475347826
related:
- id: 899133d5-4d7c-4a7f-94ee-27355c879d90
type: derived
- id: 480e7e51-e797-47e3-8d72-ebfce65b6d8d
type: derived
status: test
description: This rule identifies Windows process creation events where python.exe (or python2/python3) is invoked with code importing and calling pty spawning functionality (e.g., importing pty and using spawn). Attackers may leverage pseudo-terminal behavior to improve interactive command execution, stealth, or terminal handling during exploitation. It relies on Windows process creation telemetry, matching the executable name and specific Python command-line patterns associated with pty usage.
references:
- https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-03
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- python.exe
- python3.exe
- python2.exe
selection_cli_1:
CommandLine|contains|all:
- import pty
- .spawn(
selection_cli_2:
CommandLine|contains: from pty import spawn
condition: selection_img and 1 of selection_cli_*
falsepositives:
- Unknown
level: high
license: DRL-1.1