T1059.006 — Python

Tactic: Execution · Platforms: ESXi, Linux, macOS, Windows

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (4)

T1059.006 Command and Scripting Interpreter: Python

title: "T1059.006 Command and Scripting Interpreter: Python"
id: bfca0ed8-c6e3-4eaf-bf07-9a62e2c2a229
description: 'Cross-Platform Behavioral Detection of Python Execution. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ParentProcess, ScriptPath, TimeWindow, UserContext, ChildProcess.'
references:
  - https://attack.mitre.org/techniques/T1059/006
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.execution
  - attack.t1059.006

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\python.exe'
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\explorer.exe'

  condition: selection

falsepositives:
  - Legitimate Python-based automation launched by Office macros or scheduled scripts in environments that use Python as an admin scripting language.

level: high

T1059.006 Command and Scripting Interpreter: Python

title: "T1059.006 Command and Scripting Interpreter: Python"
id: e9252449-bbe0-4b9f-bfa0-008a7879a2a1
description: 'Cross-Platform Behavioral Detection of Python Execution. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptDir, ScheduledContext, NetworkActivity.'
references:
  - https://attack.mitre.org/techniques/T1059/006
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
  - attack.execution
  - attack.t1059.006

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/python3'
      - '/python'
    a1: '-c'
  selection_net:
    a2|contains:
      - 'socket'
      - 'subprocess'
      - 'os.system'
  condition: all of selection_*

falsepositives:
  - Legitimate automation and DevOps scripts commonly use python3 -c one-liners referencing socket/subprocess/os.system for benign administrative tasks.

level: medium

T1059.006 Command and Scripting Interpreter: Python

title: "T1059.006 Command and Scripting Interpreter: Python"
id: be2d80e3-2eef-46fd-b44e-05433f5a1163
description: 'Cross-Platform Behavioral Detection of Python Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionPath, ScriptName, SpawnChain.'
references:
  - https://attack.mitre.org/techniques/T1059/006
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.execution
  - attack.t1059.006

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/python3'
    CommandLine|contains: '-c'
  selection_pattern:
    CommandLine|contains:
      - 'base64'
      - 'exec('
      - 'eval('
  condition: selection and selection_pattern

falsepositives:
  - Legitimate Python one-liners used by developers for quick inline scripting or testing.

level: high

T1059.006 Command and Scripting Interpreter: Python

title: "T1059.006 Command and Scripting Interpreter: Python"
id: 456accb9-ef14-40a4-854d-e6bca291c99a
description: 'Cross-Platform Behavioral Detection of Python Execution. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionSource, HostUser, InstallPath.'
references:
  - https://attack.mitre.org/techniques/T1059/006
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.execution
  - attack.t1059.006

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'python '
      - 'python3 '
      - '/bin/python'

  condition: selection

falsepositives:
  - VMware support scripts and pyVmomi-based vSphere CLI automation legitimately invoke python on the ESXi shell.

level: medium

Related sub-techniques

Explore