Detection rules › Elastic
Self-Deleting Python Script
Detects Python scripts that delete themselves after execution to evade detection. This technique removes evidence of malicious activity by eliminating the script file from disk. Commonly observed in APT campaigns including those attributed to DPRK-linked threat actors like Lazarus Group.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry coverage
Rule body
[rule]
description = """
Detects Python scripts that delete themselves after execution to evade detection. This technique removes evidence of
malicious activity by eliminating the script file from disk. Commonly observed in APT campaigns including those
attributed to DPRK-linked threat actors like Lazarus Group.
"""
id = "6461f45e-b03f-4756-94d2-34a210caeb78"
license = "Elastic License v2"
name = "Self-Deleting Python Script"
os_list = ["macos"]
reference = [
"https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
"https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and
process.args_count == 2] as event0
[file where event.action == "deletion" and file.extension == "py" and
stringcontains~(event0.process.command_line, file.path)]
'''
min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.16.0"
Stages and Predicates
Ordered sequence: each step below must occur in order within 10s, correlated by process.entity_id.
Stage 1: process
[process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and
process.args_count == 2] as event0
Stage 2: file
[file where event.action == "deletion" and file.extension == "py" and
stringcontains~(event0.process.command_line, file.path)]
Indicators
These rows show field, operator, and value matches.