kevmap

TechniquesT1059.006 › AN0174

AN0174 Analytic 0174

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).</p>
Detects
T1059.006 Python
Part of
DET0063 Cross-Platform Behavioral Detection of Python Execution

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLexecveDC0032 Process Creation
linux:syslog/var/log/syslogDC0029 Script Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ScriptDirScript invoked from /tmp, /var/tmp, or .hidden/ folders.
ScheduledContextExecution from user cron or systemd timers outside of approved scripts.
NetworkActivityPython performing HTTP/HTTPS without package updates.