{"id":"T1546.018","name":"Python Startup Hooks","url":"https://attack.mitre.org/techniques/T1546/018","tactics":["persistence","privilege-escalation"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0258","stix_id":"x-mitre-detection-strategy--6034b1c9-84df-4349-b34f-957ad8ec34d3","name":"Linux Python Startup Hook Persistence via .pth and Customize Files (T1546.018)","url":"https://attack.mitre.org/detectionstrategies/DET0258","analytics":[{"id":"AN0713","stix_id":"x-mitre-analytic--e32ce63a-7c82-4115-8c50-e43113562132","name":"Analytic 0713","description":"Defender observes unauthorized modification or creation of Python hook files such as `.pth`, `sitecustomize.py`, or `usercustomize.py` in Python `site-packages`, `dist-packages`, or user paths. This is often correlated with subsequent unexpected interpreter execution (e.g., python3 running without user interaction), changes in interpreter behavior (e.g., malicious imports), and outbound connections initiated from Python. Defender links write/modify actions on hook files with execve of python process and/or anomalous child process or network activity.","url":"https://attack.mitre.org/detectionstrategies/DET0258#AN0713","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: execve where exe=/usr/bin/python3 or similar interpreter","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PATH","channel":"write or create events on *.pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-path"},{"name":"auditd:CONFIG_CHANGE","channel":"chmod or chown of hook files indicating privilege escalation or execution permission change","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"auditd-config-change"},{"name":"NSM:Flow","channel":"http::request: Outbound HTTP initiated by Python interpreter","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"HookFilePathPatterns","description":"Absolute or regex paths to Python startup files (.pth, customize.py); vary by distro or virtual environment location"},{"field":"UserContext","description":"Restrict alerts to non-root users, service accounts, or interactive shell sessions"},{"field":"TimeWindow","description":"Correlate file modification and Python execution within short time span (default: 2–5 minutes)"},{"field":"InterpreterWhitelist","description":"Filter out known legitimate Python executions tied to expected cron jobs or automation"}],"live":true,"detection_strategies":["DET0258"],"techniques":["T1546.018"]}],"live":true,"version":"1.0","techniques":["T1546.018"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}