Windows: .pth Python Path Configuration File Created in site-packages or venv
Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.
- Product
- windows
- Category
- file_event
- Author
- Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-25
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies file creation events for Python path configuration files (.pth) placed under Python library directories such as lib\site-packages (including virtual environment locations). Attackers can abuse .pth files because referenced modules are executed automatically at Python startup, enabling code execution and persistence. The detection relies on Windows file event telemetry capturing the created file path and the creating process image name, with exclusions for specific known .pth files associated with common extensions.
Reporting behind it
- volexity.comhttps://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- virustotal.comhttps://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
- docs.python.orghttps://docs.python.org/3/library/site.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_python_path_configuration_files.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: .pth Python Path Configuration File Created in site-packages or venv"
id: 7b412725-4d39-41ff-b080-6a9ff666e5c5
related:
- id: fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce
type: similar
- id: 4f394635-13ef-4599-b677-3353e0f84f55
type: similar
- id: e3652ba3-0ad8-4010-a957-b7ba369e7bac
type: derived
status: test
description: This rule identifies file creation events for Python path configuration files (.pth) placed under Python library directories such as lib\site-packages (including virtual environment locations). Attackers can abuse .pth files because referenced modules are executed automatically at Python startup, enabling code execution and persistence. The detection relies on Windows file event telemetry capturing the created file path and the creating process image name, with exclusions for specific known .pth files associated with common extensions.
references:
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
- https://docs.python.org/3/library/site.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_python_path_configuration_files.yml
author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-25
tags:
- attack.execution
- attack.t1059.006
- detection.threat-hunting
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|re: (?i)\\(venv|python(.+)?)\\lib\\site-packages\\
TargetFilename|endswith: .pth
filter_main_python:
Image|endswith: \python.exe
TargetFilename|endswith:
- \pywin32.pth
- \distutils-precedence.pth
condition: selection and not 1 of filter_main_*
falsepositives:
- Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.
level: medium
license: DRL-1.1