Sigma rule: Python Path Configuration File Creation - MacOS

Rule

Title

Python Path Configuration File Creation - MacOS

Status

test

Level

medium

Author

Andreas Braathen (mnemonic.io)

Date

2024-04-25

File

rules-threat-hunting/macos/file/file_event/file_event_macos_python_path_configuration_files.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.
Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.
Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

Log source

product

macos

category

file_event

Detection

selection:
    TargetFilename|re: '(?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/' # Unix and macOS
    TargetFilename|endswith: '.pth'
condition: selection

False positives (as the rule lists them)

• Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.

Tags

• attack.execution
• attack.t1059.006
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1059.006

Related rules

• e3652ba3-0ad8-4010-a957-b7ba369e7bac (similar)
• fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce (similar)

References

• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
• https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
• https://docs.python.org/3/library/site.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/macos/file/file_event/file_event_macos_python_path_configuration_files.yml