Techniques › T1546.018 › AN0713
AN0713 Analytic 0713
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defender observes unauthorized modification or creation of Python hook files such as
.pth, sitecustomize.py, or usercustomize.py in Python site-packages, dist-packages, or user paths. This is often correlated with subsequent unexpected interpreter execution (e.g., python3 running without user interaction), changes in interpreter behavior (e.g., malicious imports), and outbound connections initiated from Python. Defender links write/modify actions on hook files with execve of python process and/or anomalous child process or network activity.</p>- Detects
- T1546.018 Python Startup Hooks
- Part of
- DET0258 Linux Python Startup Hook Persistence via .pth and Customize Files (T1546.018)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: execve where exe=/usr/bin/python3 or similar interpreter | DC0032 Process Creation |
| auditd:PATH | write or create events on *.pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages | DC0061 File Modification |
| auditd:CONFIG_CHANGE | chmod or chown of hook files indicating privilege escalation or execution permission change | DC0059 File Metadata |
| NSM:Flow | http::request: Outbound HTTP initiated by Python interpreter | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
HookFilePathPatterns | Absolute or regex paths to Python startup files (.pth, customize.py); vary by distro or virtual environment location |
UserContext | Restrict alerts to non-root users, service accounts, or interactive shell sessions |
TimeWindow | Correlate file modification and Python execution within short time span (default: 2–5 minutes) |
InterpreterWhitelist | Filter out known legitimate Python executions tied to expected cron jobs or automation |