| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.[1]
Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Within industrial control system environments, Python libraries have been developed to implement multiple ICS protocols to establish communications with field devices. Adversaries can use these libraries or develop their own to execute commands on workstation, control server assets or send remote command messages to manipulate the industrial process through exisiting ICS protocols.
| ID | Name | Description |
|---|---|---|
| S1009 | Triton |
Triton communicates with Triconex controllers using a custom component framework written entirely in Python. The modules that implement the TriStation communication protocol and other supporting components are found in a separate file -- library.zip -- the main script that employs this functionality is compiled into a standalone py2exe Windows executable -- trilog.exe which includes a Python environment.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M0947 | Audit |
Inventory and audit Python interpreters, packages, virtual environments, execution paths, and ICS protocol libraries on assets where Python is authorized. Alert on new interpreters or packages outside approved engineering baselines. |
| M0938 | Execution Prevention |
Restrict Python execution to approved interpreters, scripts, libraries, accounts, and paths. On engineering systems where Python is required, use positive allowlisting rather than disabling the interpreter. |
| M0950 | Exploit Protection |
Apply exploit-protection controls to Python-capable Windows/Linux ICS overlap assets where supported, particularly when Python is embedded in engineering or vendor applications. |
| M1061 | Limit Software/Package Installation |
Prevent unauthorized installation of Python interpreters and packages on ICS assets. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0933 | Behavioral Detection of Python Execution in ICS | AN2094 |
Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. |
| AN2095 |
Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows. |