T1059.006 Python — Detection Rules

Source-backed rule directory

• Python One-Liners with Base64 Decoding - Linux · experimental · high · {"category":"process_creation","product":"linux"}
• AppLocker Prevented Application or Script from Running · test · medium · {"product":"windows","service":"applocker"}
• Python One-Liners with Base64 Decoding · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious File Characteristics Due to Missing Fields · test · medium · {"product":"windows","category":"process_creation"}

Atlas deterministic concepts

T1059.006 Python

MATCH(python_execution) AND script_path OR parent_process NOT_IN approved_list -> ALERT

• Process Execution Logs
• Linux Audit Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0063 Cross-Platform Behavioral Detection of Python Execution

AN0172 Analytic 0172

Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.

AN0173 Analytic 0173

Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.

AN0174 Analytic 0174

Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).

AN0175 Analytic 0175

Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.