Detect Python in CrowdStrike LogScale
Adversaries may abuse Python commands and scripts for execution. Python is a cross-platform scripting language that can be executed interactively from the command-line (via python.exe/python3), via scripts (.py), or compiled into binary executables. Python's built-in libraries for file operations, networking (socket, urllib, requests), and system interaction make it a powerful tool for adversaries. Threat actors including APT31, APT37, MuddyWater, and Contagious Interview have used Python-based implants, reverse shells, and backdoors across Windows, Linux, macOS, and ESXi environments.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.006 Python
- Canonical reference
- https://attack.mitre.org/techniques/T1059/006/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| ImageFileName = /(?i)(\\python\.exe$|\\python3\.exe$|\\pythonw\.exe$|\/python$|\/python3$)/
| CommandLine = /(?i)(socket\.socket|pty\.spawn|\/bin\/sh|\/bin\/bash|reverse_shell|reverse_tcp|urllib|requests\.get|requests\.post|http\.client|subprocess\.(call|popen|run)|os\.system|os\.popen|exec\(|eval\(|compile\(|__import__|base64\.b64decode|codecs\.decode|pyinstaller|py2exe|nuitka)/
| ReverseShell := if(CommandLine = /(?i)(socket\.socket|pty\.spawn|\/bin\/sh|reverse_shell|reverse_tcp)/, "true", "false")
| DownloadExec := if(CommandLine = /(?i)(urllib|requests\.(get|post)|http\.client)/, "true", "false")
| SubprocessExec := if(CommandLine = /(?i)(subprocess\.(call|popen|run)|os\.system|os\.popen)/, "true", "false")
| CodeExec := if(CommandLine = /(?i)(exec\(|eval\(|compile\(|__import__)/, "true", "false")
| Obfuscation := if(CommandLine = /(?i)(base64\.b64decode|codecs\.decode)/, "true", "false")
| SuspicionScore := case(ReverseShell = "true", 3, 0) + case(DownloadExec = "true", 2, 0) + case(SubprocessExec = "true", 1, 0) + case(CodeExec = "true", 2, 0) + case(Obfuscation = "true", 2, 0)
| SuspicionScore > 0
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ReverseShell, DownloadExec, SubprocessExec, CodeExec, Obfuscation, SuspicionScore])
| sort(SuspicionScore, order=desc)Detects suspicious Python interpreter execution for T1059.006 using CrowdStrike Falcon ProcessRollup2 telemetry. Filters on python.exe, python3.exe, pythonw.exe, and Linux python/python3 binaries where the command line matches reverse shell indicators (socket.socket, pty.spawn), download-and-execute patterns (urllib, requests), subprocess abuse (os.system, subprocess.Popen), dynamic code execution (exec, eval, compile, __import__), or obfuscation (base64.b64decode, codecs.decode). Computes a weighted suspicion score per event.
Data Sources
Required Tables
False Positives & Tuning
- Falcon-monitored developer workstations running Python-based tooling such as pytest, pip install hooks, or tox environments that invoke subprocess or exec internally
- Python-based IT automation agents (Puppet, Chef, SaltStack minions) that use os.system or subprocess for configuration management tasks
- Legitimate security research or red team tooling running in authorized test environments where PyInstaller or Nuitka is used to compile and distribute Python payloads under controlled conditions
Other platforms for T1059.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Python Reverse Shell One-Liner
Expected signal: Auditd: EXECVE record for python3 with -c flag and socket.socket in arguments. Network connection attempt to 127.0.0.1:4444. MDE DeviceProcessEvents and DeviceNetworkEvents on managed endpoints.
- Test 2Python Download and Execute
Expected signal: Sysmon Event ID 1: Process Create for python.exe with urllib in CommandLine. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080 (will fail without listener). The exec() call triggers even though download fails.
- Test 3Python Subprocess Command Execution
Expected signal: Sysmon Event ID 1: Process Create for python.exe with subprocess.Popen in CommandLine. Child process event for cmd.exe spawned by python.exe.
References (5)
- https://attack.mitre.org/techniques/T1059/006/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.006/T1059.006.md
- https://www.revshells.com/
- https://github.com/fortra/impacket
- https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online
Unlock Pro Content
Get the full detection package for T1059.006 including response playbook, investigation guide, and atomic red team tests.