T1059.006sub-technique of T1059 Command and Scripting Interpreter
Python
ESXi · Linux · macOS · Windowsnothing on this site yetT1059.006 on attack.mitre.org
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the `python.exe` interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Cross-Platform Behavioral Detection of Python Execution
- Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.
- Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.
- Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).
- Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.
what reduces it
- M1033 Limit Software Installation. Prevent users from installing Python where not required.
- M1038 Execution Prevention. Denylist Python where not required.
- M1049 Antivirus/Antimalware. Anti-virus can be used to automatically quarantine suspicious files.
- M1047 Audit. Inventory systems for unauthorized Python installations.