Python Initiated Connection

Title: Python Initiated Connection
Status: test
Description:Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python
  -https://pypi.org/project/scapy/
Author: frack113
Date: 2021-12-10
modified:2025-03-05
Tags:

• -'attack.discovery'
• -'attack.t1046'

Logsource:

• category: network_connection
• product: windows
• definition: Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type

Detection:
  selection:
    Initiated: 'true'
    Image|contains|all:
      -'\python'
      -'.exe'

  filter_optional_conda:
    ParentImage: 'C:\ProgramData\Anaconda3\Scripts\conda.exe'
    CommandLine|contains|all:
      -':\ProgramData\Anaconda3\Scripts\conda-script.py'
      -'update'

  filter_optional_conda_jupyter_notebook:
    ParentImage: 'C:\ProgramData\Anaconda3\python.exe'
    CommandLine|contains: 'C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py'
  filter_main_local_communication:
    DestinationIp: '127.0.0.1'
    SourceIp: '127.0.0.1'
  filter_main_pip:
    CommandLine|contains|all:
      -'pip.exe'
      -'install'

  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.
Level: medium