Detect Python Startup Hooks in Google Chronicle

rule python_startup_hook_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Python startup hook persistence via modification of sitecustomize.py, usercustomize.py, .pth files in site-packages, or PYTHONSTARTUP/PYTHONPATH registry manipulation (MITRE ATT&CK T1546.018)"
    mitre_attack_technique = "T1546.018"
    mitre_attack_tactic = "Persistence"
    severity = "HIGH"
    confidence = "MEDIUM"

  events:
    (
      // File-based Python startup hook modification
      (
        $e.metadata.event_type = "FILE_CREATION" or
        $e.metadata.event_type = "FILE_MODIFICATION"
      ) and
      (
        (
          re.regex($e.target.file.full_path, `(?i)(sitecustomize\.py|usercustomize\.py|site\.py|sitecustomize\.pyc)$`)
        ) or
        (
          re.regex($e.target.file.full_path, `\.pth$`) and
          re.regex($e.target.file.full_path, `(?i)(site-packages|dist-packages|lib/python|lib\\python)`)
        )
      ) and
      not re.regex($e.principal.process.file.full_path, `(?i)(pip|pip3|conda|poetry|venv|virtualenv|setup\.py|easy_install)`)
    ) or
    (
      // Registry-based PYTHONSTARTUP or PYTHONPATH persistence
      (
        $e.metadata.event_type = "REGISTRY_CREATION" or
        $e.metadata.event_type = "REGISTRY_MODIFICATION"
      ) and
      re.regex($e.target.registry.registry_key, `(?i)(PYTHONSTARTUP|PYTHONPATH)`) and
      re.regex($e.target.registry.registry_key, `(?i)(Environment|CurrentControlSet)`)
    )

  condition:
    $e
}