1200KM / detection
T1701.005 Python — Detection Rules
Detection workspace for T1701.005 Python: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0933 Behavioral Detection of Python Execution in ICS
AN2094 Analytic 2094
Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.
AN2095 Analytic 2095
Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1701.005 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.