T1059.006Python
T1059.006 — Python is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 72 detection use cases covering it and 42 threat-intel articles citing it.
Execution
72Use cases
42Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1059 · Command and Scripting Interpreter
Use cases covering this technique (72)
[WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) [WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint [WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains [WEEKLY] Developer package install spawning script-host with non-registry C2 within 5 minutes [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain [WEEKLY] Linux LPE chain — anomalous algif_aead/esp4/esp6/rxrpc kernel-module load followed by same-user root transition [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress [WEEKLY] Package install lifecycle hook spawns interpreter that reads developer credential stores [WEEKLY] Package-manager install hook spawns interpreter that beacons to non-registry host within 120s [WEEKLY] Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry [WEEKLY] Package-Manager Install -> Interpreter Child -> Non-Registry Egress Within 5 Minutes [WEEKLY] Package Manager Install Spawning Outbound Egress to Non-Registry Infrastructure Within 5 Minutes [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s [WEEKLY] Package manager lifecycle hook spawns runtime with outbound egress to non-registry host within 5 minutes [WEEKLY] Package manager spawns network-fetching child to public code-hosting within minutes of install [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host [LLM] Hades on-import payload: python interpreter spawns Bun runtime download [LLM] VS Code/Cursor/Claude/Gemini spawns interpreter referencing folderOpen or SessionStart hook script [LLM] CVE-2026-48039 PoC artifact execution (meta-ads-mcp-vuln001 image, FAKE_TOKEN_FOR_POC_DEMO env) [LLM] Miasma worm GitHub commit-search C2 magic strings on command line or script [LLM] Python interpreter downloads oven-sh Bun runtime v1.3.14 from GitHub releases at import time [LLM] Bun runtime executed from temp directory by Python interpreter (Hades vF203 loader) [LLM] Miasma/Shai-Hulud typosquat PyPI package installation (rsquests, tlask, langchain-core-mcp, durabletask) [LLM] Miasma Phantom Gyp: python.exe (gyp parser) spawning node index.js during npm install [LLM] Hades persistence: *-setup.pth file written into Python site-packages [LLM] VerdantBamboo BRICKSTORM / PLENET / AGENTPSD file-hash IOCs [LLM] AGENTPSD-style Python reverse shell spawned by sshd on Linux / NAS [LLM] Jinja2 SSTI payload to Jupyter Enterprise Gateway /api/kernels (CVE-2026-44181) [LLM] Enterprise Gateway python container spawns shell or reads K8s service-account token (CVE-2026-44181 RCE) [LLM] Kitty cat.py Python Backdoor File Drop / Execution (Nx Console Compromise) [LLM] Unauthenticated JSON-RPC POST to PraisonAI /a2a endpoint (CVE-2026-47391 exploit) [LLM] Suspicious child process spawned by PraisonAI uvicorn/python A2A server (eval() RCE evidence) [LLM] PraisonAI Python subprocess spawns OS shell with discovery / credential-reading commands [LLM] Literal PraisonAI sandbox-escape signature: `print.__self__` + builtins dict access [LLM] Unauthenticated POST to PraisonAI `/chat` or `/agents` endpoint (incl. CVE-Detector scanner) [LLM] PraisonAI python process spawning shell, curl, or wget (post-exploitation tool-use abuse) [LLM] Yamcs MDB algorithm PATCH with embedded Jython java.lang.Runtime payload (CVE-2026-46621) [LLM] Yamcs JVM spawns shell or network utility (CVE-2026-46621 post-exploitation) [LLM] Known Shai-Hulud / Nx Console implant hash match (SHA256/SHA1) [LLM] Python backdoor self-daemonisation via __DAEMONIZED=1 spawned by VS Code helper or node [LLM] TeamPCP Nx Console payload SHA256 hash match on developer endpoints [LLM] Compromised Microsoft durabletask PyPI Package Install (TeamPCP 1.4.1-1.4.3) [LLM] Installation of malicious guardrails-ai==0.10.1 PyPI package (CVE-2026-45758) [LLM] Python process executing transformers.pyz dropped from git-tanstack.com (TeamPCP) [LLM] python3 reading /proc/<PID>/mem to scrape Runner.Worker secrets [LLM] mistralai 2.4.6 dropper: Python interpreter executing /tmp/transformers.pyz as detached session [LLM] Vulnerable utcp-cli package (<= 1.1.1) inventory hunt for CVE-2026-45369 [LLM] DeepSeek-TUI sub-agent shell execution via AGENTS.md prompt injection (CVE-2026-45374) [LLM] Mini Shai-Hulud: Python subprocess spawns `_runtime/start.py` from lightning site-packages [LLM] Python child process executing lightning _runtime/start.py bootstrapper [LLM] Compromised elementary-data==0.23.3 PyPI install on developer / CI host [LLM] Trinny marker file creation (.trinny-security-update) [LLM] TeamPCP telnyx FetchAudio() — python subprocess running inline base64 exec [LLM] pip install of malicious telnyx versions 4.87.1 / 4.87.2 [LLM] Compromised litellm 1.82.7 / 1.82.8 PyPI install (TeamPCP supply-chain) [LLM] Linux user-systemd sysmon persistence drop (~/.config/sysmon/sysmon.py + sysmon.service) [LLM] Linux Python RAT orphaned via nohup python3 /tmp/ld.py (Axios npm payload) [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) [LLM] TeamPCP Linux/Mac stdin-piped Python second stage (sys.executable -) [LLM] TeamPCP systemd backdoor — sysmon.py / sysmon.service persistence on CI runner [LLM] Compromised bittensor-wallet 4.0.2 source-tarball SHA256 on disk [LLM] ForceMemo: Node.js v22.9.0 spawned by Python from user home directory [LLM] Python .pth startup hook executes subprocess to curl C2 (litellm fork-bomb pattern) [LLM] Cacheract memdump.py download/execution on CI runner or developer host [LLM] GitHub Actions runner — process reads runner worker memory to extract GITHUB_TOKEN [LLM] G_Wagon npm postinstall spawns python with stdin pipe (fileless payload exec) [LLM] Python parent spawns detached 'python3 -' child reading payload from stdin [LLM] Compromised tj-actions/changed-files commit SHA referenced on host (CVE-2025-30066 IOC hunt) [LLM] PyPI install footprint of num2words v0.5.15/0.5.16 (Scavenger supply-chain compromise) [LLM] Installation of poisoned Ultralytics PyPI package (v8.3.41 / 8.3.42 / 8.3.45 / 8.3.46)Articles citing this technique (42)
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-45
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-248
crit [GHSA / CRITICAL] GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package art-272
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-352