T1059.006: Python

MITRE ATT&CK® Enterprise technique

Description

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)

Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Detection

(no detection guidance published)

Data sources

• (none listed)

References

• ATT&CK page: https://attack.mitre.org/techniques/T1059/006
• ATT&CK Enterprise matrix: https://attack.mitre.org/matrices/enterprise/