Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1; Python interpreter/script execution and lineage |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3; Python-originated connection to OT or external destination |
| Field | Description |
|---|---|
| ApprovedPythonInstallations | Approved interpreter paths/hashes and embedded vendor runtimes |
| ScriptPath | Approved automation repositories versus temp/user-writable paths |
| ParentProcess | Expected vendor/engineering parents |
| UserContext | Authorized automation/service accounts |
| ApprovedDestinations | OT and external destinations Python may legitimately access |
Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve for python/python3 and script path/arguments |
| Network Connection Creation (DC0082) | linux:osquery | socket_events for Python-originated connections, where deployed |
| Field | Description |
|---|---|
| ApprovedPythonInstallations | Expected interpreter paths and vendor-embedded Python |
| ScriptDir | Approved automation paths versus /tmp, /var/tmp, hidden/user paths |
| ScheduledContext | Approved cron/systemd jobs |
| UserContext | Expected service/engineering accounts |
| ApprovedDestinations | Expected OT/external communications |