Karma-X-Inc-protections-artifacts/behavior/rules/execution_suspicious_python_script_interpreter.toml

[rule]
description = "Identifies the execution of a recently dropped executable that loads python libraries to interact with Windows APIs."
id = "20eaa6a3-6b80-48bc-9c48-a935138169f9"
license = "Elastic License v2"
name = "Suspicious Python Script Interpreter"
os_list = ["windows"]
version = "1.0.21"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and 
  process.executable != null and 
  not process.code_signature.trusted == true and 
  not process.executable :
            ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
             "?:\\Python*\\python*.exe",
             "?:\\Users\\*\\AppData\\Local\\Programs\\Python\\Python??\\python.exe",
             "?:\\Users\\*\\AppData\\Local\\anaconda?\\envs\\*\\python.exe",
             "?:\\Users\\*\\AppData\\Local\\*\\Miniconda?\\python.exe",
             "?:\\*\\Anaconda?\\python*.exe",
             "?:\\Users\\*\\AppData\\Local\\Programs\\Python\\Python*\\python.exe", 
             "?:\\ProgramData\\checkmk\\agent\\modules\\python*\\.venv\\Scripts\\python.exe") and
  not process.hash.sha256 : 
                   ("b80be3102561bf891454bd52673fdcd49d08b14c17061c077d6a88ca5ba3e9e3", 
                    "8e7bbf6e1bc3588f6d13b8372ca1bef37b6758b8a3a17bda424eba140dd4e8fe",
                    "37c3aa7e782e7331d9831ce5df27d80ac8760657ba51beb75a60b93e2d2f138b",
                    "bf2cd24734e0aba2495fa8ca138c79df8d8d56309001a69a47abbe55a1872a15",
                    "5a20b73eae6179b4553c2a066afe1ca1d9873bb1005ce1e9459d7edb9c63a280",
                    "3cfb1833ddab2145a62a7b3df311dcf4315d14ddb88f6be1e04557943e920d22",
                    "a37e022b30fd8c91ade968373fa0ca714e915a207fe4e93ac5f86fdae289cf3a",
                    "c475438563d23dc91dd9bba960b11fa1b194409967648770390f68fed62c1e57",
                    "74991c716e16c5b2ed186096e24b1f739597c48d328a52b85576911aa36ce25c",
                    "0bea60c6a85b369eb237520af21fa47c33f4bcf42d83d3cb0a9c91cfaac89959",
                    "50e109260bbaafa95d107f4bb0a9e54ec3494735c54b6da3885f2f1079e36d5b",
                    "cacde2ae530296624adbca7393f84015f0d5cb0e1c1c5a4345b91e3a841dd5f9",
                    "14f1d41be0a0218233b1b823ddb9ed3ac06603c15c56c2f11aa4a286e72c2e4e",
                    "03b8dfcf64c4e9801becb8945cdf1ebc6f3524daf5de75f662204553e97a4f05",
                    "ca78c09f7c334844dba28d0d6438ac507d14ad2874c04635cae42d398df4b6fd",
                    "8f067758c753c4d325653f2349bf5f761c4e1b4fb8a4516a152afc2375a88800",
                    "9ad4c8d68a26f6feb2287e9d9895358a5a560ecc34cb3649edade01b054e1dd5",
                    "8f8eaad0cbf91258227c1ed118813d940de56b324d358a9261f1fa18727beac1",
                    "a487293c9b2439024db52441bfa2a6220117e461e8124659bd962dcd5eb9ca58",
                    "7e5506b2975365bc490e27bf141593ec6d1da8858311b7dc1872dce1681ed1e5",
                    "dc9d9b130c2271fb3d5ebce3f10b84682d7c420ccb72220f7942f40b9e833c82",
                    "273823283ed4d333a585462dba323186bbb436522182488936879aa3af35cfbb",
                    "39813ef813924c17f0b19aef66b7b80987670e39a3f6daae2ef0b5a0b62f71e0",
                    "c70fa68e604f91387bbe920971057cb04148c0fed4142124ccd9226abfb93538",
                    "afbe4150814176a86abb7192b14465b88a0cbf3a58b512eaa533fb56dccc6077",
                    "7351523031359477a5ac0e6d39b04dec624fd3e990f85e698b6f2a77873963fd",
                    "a53af751d32103fab234be6ae680fc0f6057989d8ff1486d8d5b26ccde0b3d70",
                    "1a59794c7c29f4569a0fe87bc9d9ffbf57835358c69f957950cd9718151f1af6",
                    "3d8595f90fb478cb0f3673a4e5162ac054638fe699a3879ad47514cf872077dd",
                    "87c927fb0f347bcb689d115e6515b285302d2253cab727924924b85da9056a9e", 
                    "ff6b583cfc19ea28e9d3580af49e6db71675a5869e27de5f2940580948258b32", 
                    "31f692eaa4a205f52235f43ee69b23c6789b45ed11e5a831e9b9b460c3985867")
  ]
 [library where dll.name : ("win32api*.pyd", "win32process.pyd", "win32security.pyd", "md.cp*-win32.pyd", "win32crypt.pyd", "win32net.pyd")]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"