Skip to content

Detections against malicious Python package activities - #4205

Open
onurmerdogan wants to merge 3 commits into
developfrom
python_malicious_install
Open

Detections against malicious Python package activities#4205
onurmerdogan wants to merge 3 commits into
developfrom
python_malicious_install

Conversation

@onurmerdogan

Copy link
Copy Markdown

Details

This PR contains detections against malicious activities during Python package installations.

Stories

  • Malicious Python Package Installation: New story in order to track malicious activities during Python package installations. Covers both installation and build related activities.

Detections

  • Python Network Traffic during Package Build: Detects a Python process making an outbound network connection during package installation.
  • Python PTH File Creation during Package Installation: detects the creation of a Python path configuration (.pth) file in conjunction with a package installation process.
  • Python PYTHONPATH Modification During Package Installation: Detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
  • Python Site Hooks Creation during Package Installation: Detects the creation of a Python site hook file within a packages directory in conjunction with a package installation process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant