From d28647d6e29991029d8b576d71676aba2ae2b99c Mon Sep 17 00:00:00 2001 From: oerdogan Date: Thu, 23 Jul 2026 16:31:56 +0200 Subject: [PATCH] Attack Data for Malicious Python Package Installations --- .../python_network_traffic.log | 2 ++ .../python_network_traffic.yml | 13 +++++++++++++ .../python_pth_file_creation.log | 2 ++ .../python_pth_file_creation.yml | 13 +++++++++++++ .../python_site_hooks_creation.log | 2 ++ .../python_site_hooks_creation.yml | 13 +++++++++++++ .../python_pythonpath_modification.log | 2 ++ .../python_pythonpath_modification.yml | 13 +++++++++++++ 8 files changed, 60 insertions(+) create mode 100644 datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log create mode 100644 datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.yml create mode 100644 datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log create mode 100644 datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.yml create mode 100644 datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log create mode 100644 datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.yml create mode 100644 datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log create mode 100644 datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.yml diff --git a/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log b/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log new file mode 100644 index 000000000..f2d2fb609 --- /dev/null +++ b/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log @@ -0,0 +1,2 @@ +354300x80000000000000001995Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7Usermode2026-07-16 15:45:13.835{869c0a82-fc89-6a58-5d03-000000007702}4372C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exeEC2AMAZ-CEMU0P7\Administratortcptruefalse10.0.2.11EC2AMAZ-CEMU0P7.eu-west-1.compute.internal50169-false34.117.59.8181.59.117.34.bc.googleusercontent.com443https +154100x80000000000000001978Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7-2026-07-16 15:45:13.809{869c0a82-fc89-6a58-5d03-000000007702}4372C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe3.14.6PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\ADMINI~1\AppData\Local\Temp\2\tmpy3b5cpxnC:\Users\Administrator\AppData\Local\Temp\2\pip-req-build-_qa26iz2\EC2AMAZ-CEMU0P7\Administrator{869c0a82-f20c-6a58-2b83-0a0000000000}0xa832b2HighMD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7{869c0a82-fc89-6a58-5c03-000000007702}3736C:\Users\Administrator\Desktop\redpy\Scripts\python.exeC:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\ADMINI~1\AppData\Local\Temp\2\tmpy3b5cpxnEC2AMAZ-CEMU0P7\Administrator diff --git a/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.yml b/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.yml new file mode 100644 index 000000000..8644cc07e --- /dev/null +++ b/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 21cfdb7e-032e-467c-8fa7-688b20b1cd7b +date: '2026-07-23' +description: Generated datasets for Python network traffic in attack range. +environment: attack_range +directory: python_network_traffic +mitre_technique: +- T1195.002 +datasets: +- name: python_network_traffic.log + path: /datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log + sourcetype: 'XmlWinEventLog' + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' \ No newline at end of file diff --git a/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log b/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log new file mode 100644 index 000000000..f564349fc --- /dev/null +++ b/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log @@ -0,0 +1,2 @@ +11241100x800000000000000042690Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7T1546.0182026-07-20 11:42:40.861{869c0a82-09ae-6a5e-948d-000000007702}4484C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Administrator\Desktop\redpy\Lib\site-packages\redpy.pth2026-07-20 11:42:40.861EC2AMAZ-CEMU0P7\Administrator +154100x800000000000000042526Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7-2026-07-20 11:42:38.012{869c0a82-09ae-6a5e-948d-000000007702}4484C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe3.14.6PythonPythonPython Software Foundationpython.exe"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe" "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.2.tar.gzC:\Users\Administrator\Desktop\redpy\EC2AMAZ-CEMU0P7\Administrator{869c0a82-f20c-6a58-2b83-0a0000000000}0xa832b2HighMD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7{869c0a82-09ae-6a5e-938d-000000007702}6524C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe" "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.2.tar.gzEC2AMAZ-CEMU0P7\Administrator \ No newline at end of file diff --git a/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.yml b/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.yml new file mode 100644 index 000000000..b4426e6fc --- /dev/null +++ b/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 177ddfaa-80ee-42f7-a2e5-774995898a13 +date: '2026-07-23' +description: Generated datasets for Python .pth file creation in attack range. +environment: attack_range +directory: python_pth_file_creation +mitre_technique: +- T1546 +datasets: +- name: python_pth_file_creation.log + path: /datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log + sourcetype: 'XmlWinEventLog' + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' \ No newline at end of file diff --git a/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log b/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log new file mode 100644 index 000000000..b45c44b8f --- /dev/null +++ b/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log @@ -0,0 +1,2 @@ +11241100x800000000000000042500Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7T1546.0182026-07-20 11:42:11.649{869c0a82-0990-6a5e-7e8d-000000007702}3696C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Administrator\Desktop\redpy\Lib\site-packages\sitecustomize.py2026-07-20 11:42:11.649EC2AMAZ-CEMU0P7\Administrator +154100x800000000000000042337Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7-2026-07-20 11:42:08.798{869c0a82-0990-6a5e-7e8d-000000007702}3696C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe3.14.6PythonPythonPython Software Foundationpython.exe"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe" "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.3.tar.gzC:\Users\Administrator\Desktop\redpy\EC2AMAZ-CEMU0P7\Administrator{869c0a82-f20c-6a58-2b83-0a0000000000}0xa832b2HighMD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7{869c0a82-0990-6a5e-7d8d-000000007702}6652C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe" "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.3.tar.gzEC2AMAZ-CEMU0P7\Administrator \ No newline at end of file diff --git a/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.yml b/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.yml new file mode 100644 index 000000000..4275149e3 --- /dev/null +++ b/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 0825a28f-b3c7-44a2-b3dc-e0bfa3da0447 +date: '2026-07-23' +description: Generated datasets for Python site hooks creation during package installation in attack range. +environment: attack_range +directory: python_site_hooks_creation +mitre_technique: +- T1546 +datasets: +- name: python_site_hooks_creation.log + path: /datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log + sourcetype: 'XmlWinEventLog' + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' \ No newline at end of file diff --git a/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log b/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log new file mode 100644 index 000000000..078b7834a --- /dev/null +++ b/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log @@ -0,0 +1,2 @@ +13241300x800000000000000045122Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7EnvVarSetValue2026-07-20 13:06:28.627{869c0a82-1d54-6a5e-a790-000000007702}6176C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKU\S-1-5-21-814534664-756003823-1488211838-500\Environment\PYTHONPATHC:\Users\Administrator\Desktop\redpy\Lib\site-packages\redpy_demoEC2AMAZ-CEMU0P7\Administrator +154100x800000000000000044383Microsoft-Windows-Sysmon/OperationalEC2AMAZ-CEMU0P7T1059.0062026-07-20 13:06:01.213{869c0a82-1d39-6a5e-8790-000000007702}6176C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe3.14.6PythonPythonPython Software Foundationpython.exeC:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Administrator\AppData\Local\Temp\2\pip-build-env-bdqrqxas\overlay --no-warn-script-location --disable-pip-version-check --no-compile --target "" --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0C:\Users\Administrator\Desktop\redpy\EC2AMAZ-CEMU0P7\Administrator{869c0a82-f20c-6a58-2b83-0a0000000000}0xa832b2HighMD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7{869c0a82-1d39-6a5e-8690-000000007702}2680C:\Users\Administrator\Desktop\redpy\Scripts\python.exeC:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Administrator\AppData\Local\Temp\2\pip-build-env-bdqrqxas\overlay --no-warn-script-location --disable-pip-version-check --no-compile --target "" --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0EC2AMAZ-CEMU0P7\Administrator \ No newline at end of file diff --git a/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.yml b/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.yml new file mode 100644 index 000000000..6580db3f0 --- /dev/null +++ b/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: e5a0e812-8fdd-4aea-ae7a-a8f99e5e7c5e +date: '2026-07-23' +description: Generated datasets for Python PYTHONPATH environment variable modification in attack range. +environment: attack_range +directory: python_pythonpath_modification +mitre_technique: +- T1574.007 +datasets: +- name: python_pythonpath_modification.log + path: /datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log + sourcetype: 'XmlWinEventLog' + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' \ No newline at end of file