Python Initiated Connection
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND (IS_INITIATED = "true" AND (PROCESSNAME contains "\python" AND PROCESSNAME contains ".exe")) AND ((DEST_IP != "127.0.0.1" OR SOURCE_IP != "127.0.0.1") AND (COMMANDLINE notcontains "pip.exe" OR COMMANDLINE notcontains "install")) AND ((PARENTPROCESSNAME != "C:\ProgramData\Anaconda3\Scripts\conda.exe" OR (COMMANDLINE notcontains ":\ProgramData\Anaconda3\Scripts\conda-script.py" OR COMMANDLINE notcontains "update")) AND (PARENTPROCESSNAME != "C:\ProgramData\Anaconda3\python.exe" OR COMMANDLINE notcontains "C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
