Sigma rule: Python Initiated Connection

Rule

Title

Python Initiated Connection

Status

test

Level

medium

Author

frack113

Date

2021-12-10

Modified

2025-03-05

File

rules/windows/network_connection/net_connection_win_python.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Log source

product

windows

category

network_connection

definition

Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type

Detection

selection:
    Initiated: 'true'
    Image|contains|all:
        - '\python'
        - '.exe'
filter_optional_conda:
    # Related to anaconda updates. Command example: "conda update conda"
    # This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
    ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe
    CommandLine|contains|all:
        - ':\ProgramData\Anaconda3\Scripts\conda-script.py'
        - 'update'
filter_optional_conda_jupyter_notebook:
    # Related to anaconda opening an instance of Jupyter Notebook
    # This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
    ParentImage: C:\ProgramData\Anaconda3\python.exe
    CommandLine|contains: 'C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py'
filter_main_local_communication:
    # This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
    DestinationIp: 127.0.0.1
    SourceIp: 127.0.0.1
filter_main_pip:
    CommandLine|contains|all:
        - 'pip.exe'
        - 'install'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.

Tags

• attack.discovery
• attack.t1046

MITRE ATT&CK ids this rule names

• T1046

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python
• https://pypi.org/project/scapy/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_python.yml