T1059.006 Python — Attack Simulation

Technique description

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables. Python comes with many built-in packages to interact…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Execute Python via Python executables
  linuxautomatedsh

  Procedure 0b44d79b-570a-4b27-a31f-3bf2156e5eaa; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Python pty module and spawn function used to spawn sh or bash
  linuxautomatedsh

  Procedure 161d694c-b543-4434-85c3-c3a433e33792; elevation not declared required; cleanup not declared. Not executed or individually validated.

• Execute shell script via python's command mode arguement
  linuxautomatedsh

  Procedure 3a95cdb2-c6ea-4761-b24e-02b71889b8bb; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Execute Python via scripts
  linuxautomatedsh

  Procedure 6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.