Applied Cybernetics Group
T1059.006 Python
- Technique
T1059.006- Tactics
- Execution
- Research, 90 days
- 4
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 13
- Elastic, Splunk
- 48
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1059/006
MITRE description
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-19Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 -
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering -
2026-10-08Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware -
2026-10-06Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
Detection coverage
SigmaHQ community rules
- Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution (emerging-threats)
- Emotet Loader Execution Via .LNK File (emerging-threats)
- Serpent Backdoor Payload Execution Via Scheduled Task (emerging-threats)
- Axios NPM Compromise Indicators - Linux (emerging-threats)
- TanStack Supply-Chain Attack Execution Indicators - Linux (emerging-threats)
- Python Path Configuration File Creation - Linux (threat-hunting)
- Python Path Configuration File Creation - MacOS (threat-hunting)
- Python Path Configuration File Creation - Windows (threat-hunting)
- Python One-Liners with Base64 Decoding - Linux (core)
- AppLocker Prevented Application or Script from Running (core)
- AppLocker Application Would Have Been Blocked (core)
- Python One-Liners with Base64 Decoding (core)
- Suspicious File Characteristics Due to Missing Fields (core)
Elastic and Splunk rules
- ROT Encoded Python Script Execution (elastic)
- Long Base64 Encoded Command via Scripting Interpreter (elastic)
- Cloud Offensive Framework Execution (elastic)
- Execution via OpenClaw Agent (elastic)
- Potential Prompt Injection Coercing Shell Execution (elastic)
- Potential SAP NetWeaver Exploitation (elastic)
- Potential Java Service Exploitation via Suspicious Child Process (elastic)
- Suspicious Process Execution by Zoom (elastic)
- Suspicious Python Shell Command Execution (elastic)
- Execution via GitHub Actions Runner (elastic)
- Suspicious React Server Child Process (elastic)
- Shell or Suspicious Process Spawned by Ray Worker (elastic)
- Web Server Potential Command Injection Request (elastic)
- Decoded Payload Piped to Interpreter Detected via Defend for Containers (elastic)
- Encoded Payload Detected via Defend for Containers (elastic)
- Payload Execution via Shell Pipe Detected by Defend for Containers (elastic)
- Suspicious Interpreter Execution Detected via Defend for Containers (elastic)
- First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN (elastic)
- Unusual Base64 Encoding/Decoding Activity (elastic)
- Potential Hex Payload Execution via Common Utility (elastic)
- Base64 Decoded Payload Piped to Interpreter (elastic)
- Interactive Terminal Spawned via Python (elastic)
- Web Server Spawned via Python (elastic)
- Potential Reverse Shell via Suspicious Child Process (elastic)
- Potential Reverse Shell via UDP (elastic)
Showing 25 of 48.