T1546.018 — Python Startup Hooks

Tactics: Persistence, Privilege Escalation · Platforms: Linux, macOS, Windows

Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (`.pth`) files and the `sitecustomize.py` or `usercustomize.py` modules. These files are automatically processed during the initialization of the Python interpreter, allowing for the…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.018 Event Triggered Execution: Python Startup Hooks

title: "T1546.018 Event Triggered Execution: Python Startup Hooks"
id: d3a8edd7-1ad3-4e31-a135-70f22e81ae85
description: 'T1546.018 Python Startup Hooks: the technique is code execution triggered by .pth path-configuration files or sitecustomize.py/usercustomize.py at Python interpreter startup, not routine "pip install --user" package installation (which never observes hook-file creation or interpreter-triggered execution). Retargeted to auditd PATH-record file creation/modification of .pth files under site-packages/dist-packages, or of sitecustomize.py/usercustomize.py anywhere on the Python path (requires an auditd watch rule on these directories, e.g. -w <site-packages-path> -p wa). Tune using: HookFilePathPatterns, UserContext, TimeWindow, InterpreterWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1546/018
author: Shahrukh Khan
date: 2026-03-12
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.018

logsource:
  category: file_event
  product: linux

detection:
  selection_pth_file:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|endswith: '.pth'
    name|contains:
      - 'site-packages'
      - 'dist-packages'
  selection_customize_file:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|endswith:
      - '/sitecustomize.py'
      - '/usercustomize.py'
  condition: selection_pth_file or selection_customize_file

falsepositives:
  - Legitimate package installation via pip/setuptools that lays down .pth files (e.g. easy-install.pth, editable installs) as part of normal environment setup; correlate with an approved-package allowlist and unexpected-content review of the hook file itself.

level: medium

Related sub-techniques

Explore