MITRE ATT&CKsub-technique

T1059.006 Python

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-09

Description

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables. Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1033 Limit Software Installation mitigation
  • M1038 Execution Prevention mitigation
  • M1047 Audit mitigation
  • M1049 Antivirus/Antimalware mitigation

Referenced by MITRE ATT&CK · uses (66)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • G1055 VOID MANTICORE group
  • S9024 SPAWNCHIMERA software (malware)
  • S9013 DRYHOOK software (malware)
  • C0059 Salesforce Data Exfiltration campaign
  • G1052 Contagious Interview group
  • S1245 InvisibleFerret software (malware)
  • S1223 THINCRUST software (malware)
  • S1218 VIRTUALPIE software (malware)
  • S1217 VIRTUALPITA software (malware)
  • G1048 UNC3886 group
  • S1213 Lumma Stealer software (malware)
  • G1045 Salt Typhoon group
  • S1187 reGeorg software (malware)
  • S1189 Neo-reGeorg software (malware)
  • C0045 ShadowRay campaign
  • S1164 UPSTYLE software (malware)
  • G1039 RedCurl group
  • S1120 FRAMESTING software (malware)
  • C0029 Cutting Edge campaign
  • G1021 Cinnamon Tempest group
  • C0014 Operation Wocao campaign
  • S1035 Small Sieve software (malware)
  • S1032 PyDCrypt software (malware)
  • G1006 Earth Lusca group
Show all 66 ›

Referenced by Compliance · mitigates (21)

  • CIS-10.7 Use Behavior-Based Anti-Malware Software CIS Safeguard v8.1
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-2.3 Address Unauthorized Software CIS Safeguard v8.1
  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References