Forensia CTI Core

About

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables. Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Platforms: ESXi, Linux, macOS, WindowsParent: T1059 Command and Scripting InterpreterMITRE ATT&CK ↗

Used by actors

18 known groups

G0010 Turla G0016 APT29 G0035 Dragonfly G0060 BRONZE BUTLER G0067 APT37 G0069 MuddyWater G0087 APT39 G0094 Kimsuky G0095 Machete G0106 Rocke G0128 ZIRCONIUM G0131 Tonto Team G1006 Earth Lusca G1021 Cinnamon Tempest G1039 RedCurl G1048 UNC3886 G1052 Contagious Interview G1055 VOID MANTICORE

Software

37 malware/tools implement this

Cobalt StrikePupyPUNCHBUGGYBandookKeydnapRemcosCoinTickerSpeakUpEburyKeyBoyMachetePoetRATMechaFlounderBundloreCookieMinerDropBookIronNetInjectorPysaChaesTurianLizarSILENTTRINITYDonutPyDCryptSmall SieveFRAMESTINGUPSTYLEreGeorgNeo-reGeorgLumma StealerVIRTUALPITAVIRTUALPIETHINCRUSTInvisibleFerretDRYHOOKSPAWNCHIMERALAMEHUG

Corpus indicators tagged with this technique

216 indicators in the corpus carry T1059.006.

Indicator	Type	Family	Sev	Src
cve-2021-27137	cve	—	85	8
cve-2025-34054	cve	—	85	4
cve-2016-15047	cve	—	85	4
b1b7aaa5bd4408a4d3003a9fabcdd041	hash	—	80	3
aeaf583e20347bf850e2fabdcd6f4982996ba023f8c2cd56bbd299cfd56516f5	hash	supply_chain	80	1
6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9	hash	supply_chain	80	2
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce	hash	supply_chain	80	1
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
7d80b3ef74ad7992b93c31966962612e4e2ceb93e7727cdbd1d2a9af47d44ba8	hash	supply_chain	80	1
52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7	hash	phishing	80	2
62761f38ed194c59abe15c49f09f0ebc431ac852c965180c9327ed84d3a454fb	hash	phishing	80	2
6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2	hash	supply_chain	80	2
00e195d94d3b1f7092eb9ed132f89d1b	hash	—	80	3
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
625b6535321d58bb5c613e85332bf731	hash	—	80	3
4c0d9b802c075be79e9edb52d88f8dd72e6904f5c58267213745818470945c78	hash	phishing	80	2
808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619	hash	phishing	80	2
bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81	hash	phishing	80	2
d3ebce2f05fe91a8260e87fd11a6ea17c156703d081b3f91d9bbe5fd6aeedc10	hash	phishing	80	2
d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e	hash	phishing	80	2
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525	sha256	prompt_injection	80	2
eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386	hash	—	80	4
3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1a	sha256	ransomware	80	1
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568	sha256	ransomware	80	1
84ad78b2bab946c3677fdc28ebd8a774	hash	—	80	3

Showing the top 30 by severity of 216.