Windows Creation of Python .pth Path Configuration Files in site-packages

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.

FreeUnreviewedSigmamediumv1

windows-creation-of-python-pth-path-configuration-files-in-site-packages-e3652ba3

title: Windows Creation of Python .pth Path Configuration Files in site-packages
id: 7b412725-4d39-41ff-b080-6a9ff666e5c5
related:
  - id: fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce
    type: similar
  - id: 4f394635-13ef-4599-b677-3353e0f84f55
    type: similar
  - id: e3652ba3-0ad8-4010-a957-b7ba369e7bac
    type: derived
status: test
description: This rule flags the creation of Python .pth path configuration files within Python library folders under Windows, specifically under venv or lib\site-packages paths. .pth contents are processed on Python startup, so a newly created file can be abused to execute attacker-controlled code or maintain persistence without needing an explicit import by the running script. It relies on Windows file creation events that include the target filename and image path of the creating process.
references:
  - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
  - https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
  - https://docs.python.org/3/library/site.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_python_path_configuration_files.yml
author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-25
tags:
  - attack.execution
  - attack.t1059.006
  - detection.threat-hunting
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|re: (?i)\\(venv|python(.+)?)\\lib\\site-packages\\
    TargetFilename|endswith: .pth
  filter_main_python:
    Image|endswith: \python.exe
    TargetFilename|endswith:
      - \pywin32.pth
      - \distutils-precedence.pth
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.
level: medium
license: DRL-1.1

What it detects

This rule flags the creation of Python .pth path configuration files within Python library folders under Windows, specifically under venv or lib\site-packages paths. .pth contents are processed on Python startup, so a newly created file can be abused to execute attacker-controlled code or maintain persistence without needing an explicit import by the running script. It relies on Windows file creation events that include the target filename and image path of the creating process.

Known false positives

Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.