ROT encoded Python Script Execution

[rule]
description = """
Detects Python execution followed by creation of ROT cipher-encoded bytecode files (rot_XX.cpython-*.pyc) within 10
seconds. This pattern indicates malicious Python packages using ROT encoding to obfuscate code and evade static
analysis. The technique has been observed in supply chain attacks, particularly by DPRK groups targeting cryptocurrency
sectors.
"""
id = "fdbe99cd-6633-4775-9535-9fd3095ac77a"
license = "Elastic License v2"
name = "ROT encoded Python Script Execution"
os_list = ["macos"]
reference = ["https://www.elastic.co/security-labs/dprk-code-of-conduct"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=10s
 [process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and process.args like~ ("*.py", "*.pyc") and
   not process.parent.executable in ("/Library/Developer/CommandLineTools/usr/bin/make", "/Applications/Xcode.app/Contents/Developer/usr/bin/make")]
 [file where event.action == "modification" and process.name like~ "python*" and file.name like~ "rot_??.cpython-*.pyc*"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.013"
name = "Encrypted/Encoded File"
reference = "https://attack.mitre.org/techniques/T1027/013/"


[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"