T1059.006Execution
Python
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
13 Sigma rules tagged T1059.006PythonT1059.00613 general rules
- Emotet Loader Execution Via .LNK Filehightest
- Serpent Backdoor Payload Execution Via Scheduled Taskhightest
- Axios NPM Compromise Indicators - Linuxhighexperimental
- Python One-Liners with Base64 Decodinghighexperimental
- Python One-Liners with Base64 Decoding - Linuxhighexperimental
- TanStack Supply-Chain Attack Execution Indicators - Linuxhighexperimental
- AppLocker Prevented Application or Script from Runningmediumtest
- Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Python
1 CVE, by priority. Each link shows its badge.- CVE-2019-16784Local Privilege Escalation present only on the Windows version of PyInstallerPyInstaller · PyInstallerPublic exploitHigh · 7.0T1190Exploit Public-Facing ApplicationT1059.006Python+1 moreMITRE CTID mapping of the CVE · follow-on activity0.7%Top 47%20.5priority