Attack Data for Malicious Python Package Installations

datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log

@@ -0,0 +1,2 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>3</EventID><Version>5</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-16T15:45:16.2412667Z'/><EventRecordID>1995</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3400'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>Usermode</Data><Data Name='UtcTime'>2026-07-16 15:45:13.835</Data><Data Name='ProcessGuid'>{869c0a82-fc89-6a58-5d03-000000007702}</Data><Data Name='ProcessId'>4372</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data><Data Name='Protocol'>tcp</Data><Data Name='Initiated'>true</Data><Data Name='SourceIsIpv6'>false</Data><Data Name='SourceIp'>10.0.2.11</Data><Data Name='SourceHostname'>EC2AMAZ-CEMU0P7.eu-west-1.compute.internal</Data><Data Name='SourcePort'>50169</Data><Data Name='SourcePortName'>-</Data><Data Name='DestinationIsIpv6'>false</Data><Data Name='DestinationIp'>34.117.59.81</Data><Data Name='DestinationHostname'>81.59.117.34.bc.googleusercontent.com</Data><Data Name='DestinationPort'>443</Data><Data Name='DestinationPortName'>https</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-16T15:45:13.8108192Z'/><EventRecordID>1978</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-07-16 15:45:13.809</Data><Data Name='ProcessGuid'>{869c0a82-fc89-6a58-5d03-000000007702}</Data><Data Name='ProcessId'>4372</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='FileVersion'>3.14.6</Data><Data Name='Description'>Python</Data><Data Name='Product'>Python</Data><Data Name='Company'>Python Software Foundation</Data><Data Name='OriginalFileName'>python.exe</Data><Data Name='CommandLine'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\ADMINI~1\AppData\Local\Temp\2\tmpy3b5cpxn</Data><Data Name='CurrentDirectory'>C:\Users\Administrator\AppData\Local\Temp\2\pip-req-build-_qa26iz2\</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data><Data Name='LogonGuid'>{869c0a82-f20c-6a58-2b83-0a0000000000}</Data><Data Name='LogonId'>0xa832b</Data><Data Name='TerminalSessionId'>2</Data><Data Name='IntegrityLevel'>High</Data><Data Name='Hashes'>MD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7</Data><Data Name='ParentProcessGuid'>{869c0a82-fc89-6a58-5c03-000000007702}</Data><Data Name='ParentProcessId'>3736</Data><Data Name='ParentImage'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe</Data><Data Name='ParentCommandLine'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py build_wheel C:\Users\ADMINI~1\AppData\Local\Temp\2\tmpy3b5cpxn</Data><Data Name='ParentUser'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>

datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 21cfdb7e-032e-467c-8fa7-688b20b1cd7b
+date: '2026-07-23'
+description: Generated datasets for Python network traffic in attack range.
+environment: attack_range
+directory: python_network_traffic
+mitre_technique:
+- T1195.002
+datasets:
+- name: python_network_traffic.log
+  path: /datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log

@@ -0,0 +1,2 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>11</EventID><Version>2</Version><Level>4</Level><Task>11</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T11:42:40.8667519Z'/><EventRecordID>42690</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>T1546.018</Data><Data Name='UtcTime'>2026-07-20 11:42:40.861</Data><Data Name='ProcessGuid'>{869c0a82-09ae-6a5e-948d-000000007702}</Data><Data Name='ProcessId'>4484</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='TargetFilename'>C:\Users\Administrator\Desktop\redpy\Lib\site-packages\redpy.pth</Data><Data Name='CreationUtcTime'>2026-07-20 11:42:40.861</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T11:42:38.0144166Z'/><EventRecordID>42526</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-07-20 11:42:38.012</Data><Data Name='ProcessGuid'>{869c0a82-09ae-6a5e-948d-000000007702}</Data><Data Name='ProcessId'>4484</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='FileVersion'>3.14.6</Data><Data Name='Description'>Python</Data><Data Name='Product'>Python</Data><Data Name='Company'>Python Software Foundation</Data><Data Name='OriginalFileName'>python.exe</Data><Data Name='CommandLine'>"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"  "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.2.tar.gz</Data><Data Name='CurrentDirectory'>C:\Users\Administrator\Desktop\redpy\</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data><Data Name='LogonGuid'>{869c0a82-f20c-6a58-2b83-0a0000000000}</Data><Data Name='LogonId'>0xa832b</Data><Data Name='TerminalSessionId'>2</Data><Data Name='IntegrityLevel'>High</Data><Data Name='Hashes'>MD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7</Data><Data Name='ParentProcessGuid'>{869c0a82-09ae-6a5e-938d-000000007702}</Data><Data Name='ParentProcessId'>6524</Data><Data Name='ParentImage'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe</Data><Data Name='ParentCommandLine'>"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"  "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.2.tar.gz</Data><Data Name='ParentUser'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>

datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 177ddfaa-80ee-42f7-a2e5-774995898a13
+date: '2026-07-23'
+description: Generated datasets for Python .pth file creation in attack range.
+environment: attack_range
+directory: python_pth_file_creation
+mitre_technique:
+- T1546
+datasets:
+- name: python_pth_file_creation.log
+  path: /datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log

@@ -0,0 +1,2 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>11</EventID><Version>2</Version><Level>4</Level><Task>11</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T11:42:11.6559333Z'/><EventRecordID>42500</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>T1546.018</Data><Data Name='UtcTime'>2026-07-20 11:42:11.649</Data><Data Name='ProcessGuid'>{869c0a82-0990-6a5e-7e8d-000000007702}</Data><Data Name='ProcessId'>3696</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='TargetFilename'>C:\Users\Administrator\Desktop\redpy\Lib\site-packages\sitecustomize.py</Data><Data Name='CreationUtcTime'>2026-07-20 11:42:11.649</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T11:42:08.7996458Z'/><EventRecordID>42337</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-07-20 11:42:08.798</Data><Data Name='ProcessGuid'>{869c0a82-0990-6a5e-7e8d-000000007702}</Data><Data Name='ProcessId'>3696</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='FileVersion'>3.14.6</Data><Data Name='Description'>Python</Data><Data Name='Product'>Python</Data><Data Name='Company'>Python Software Foundation</Data><Data Name='OriginalFileName'>python.exe</Data><Data Name='CommandLine'>"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"  "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.3.tar.gz</Data><Data Name='CurrentDirectory'>C:\Users\Administrator\Desktop\redpy\</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data><Data Name='LogonGuid'>{869c0a82-f20c-6a58-2b83-0a0000000000}</Data><Data Name='LogonId'>0xa832b</Data><Data Name='TerminalSessionId'>2</Data><Data Name='IntegrityLevel'>High</Data><Data Name='Hashes'>MD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7</Data><Data Name='ParentProcessGuid'>{869c0a82-0990-6a5e-7d8d-000000007702}</Data><Data Name='ParentProcessId'>6652</Data><Data Name='ParentImage'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe</Data><Data Name='ParentCommandLine'>"C:\Users\Administrator\Desktop\redpy\Scripts\python.exe"  "C:\Users\Administrator\Desktop\redpy\Scripts\pip.exe" install .\redpy_demo-1.0.3.tar.gz</Data><Data Name='ParentUser'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>

datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 0825a28f-b3c7-44a2-b3dc-e0bfa3da0447
+date: '2026-07-23'
+description: Generated datasets for Python site hooks creation during package installation in attack range.
+environment: attack_range
+directory: python_site_hooks_creation
+mitre_technique:
+- T1546
+datasets:
+- name: python_site_hooks_creation.log
+  path: /datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log

@@ -0,0 +1,2 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>13</EventID><Version>2</Version><Level>4</Level><Task>13</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T13:06:28.6342586Z'/><EventRecordID>45122</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>EnvVar</Data><Data Name='EventType'>SetValue</Data><Data Name='UtcTime'>2026-07-20 13:06:28.627</Data><Data Name='ProcessGuid'>{869c0a82-1d54-6a5e-a790-000000007702}</Data><Data Name='ProcessId'>6176</Data><Data Name='Image'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='TargetObject'>HKU\S-1-5-21-814534664-756003823-1488211838-500\Environment\PYTHONPATH</Data><Data Name='Details'>C:\Users\Administrator\Desktop\redpy\Lib\site-packages\redpy_demo</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-07-20T13:06:01.2144898Z'/><EventRecordID>44383</EventRecordID><Correlation/><Execution ProcessID='2716' ThreadID='3412'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-CEMU0P7</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>T1059.006</Data><Data Name='UtcTime'>2026-07-20 13:06:01.213</Data><Data Name='ProcessGuid'>{869c0a82-1d39-6a5e-8790-000000007702}</Data><Data Name='ProcessId'>6176</Data><Data Name='Image'>C:\Users\Administrator\AppData\Local\Programs\Python\Python314\python.exe</Data><Data Name='FileVersion'>3.14.6</Data><Data Name='Description'>Python</Data><Data Name='Product'>Python</Data><Data Name='Company'>Python Software Foundation</Data><Data Name='OriginalFileName'>python.exe</Data><Data Name='CommandLine'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Administrator\AppData\Local\Temp\2\pip-build-env-bdqrqxas\overlay --no-warn-script-location --disable-pip-version-check --no-compile --target "" --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools&gt;=40.8.0</Data><Data Name='CurrentDirectory'>C:\Users\Administrator\Desktop\redpy\</Data><Data Name='User'>EC2AMAZ-CEMU0P7\Administrator</Data><Data Name='LogonGuid'>{869c0a82-f20c-6a58-2b83-0a0000000000}</Data><Data Name='LogonId'>0xa832b</Data><Data Name='TerminalSessionId'>2</Data><Data Name='IntegrityLevel'>High</Data><Data Name='Hashes'>MD5=5AF6D8DFE0F5B64C65EDA60D23C2C199,SHA256=03168C01B7B7491423350E82C26FEE71F35B43694D1319D3C668BDA6903A0C38,IMPHASH=A0FAD384DB41CC8B86FA51996BB88AC7</Data><Data Name='ParentProcessGuid'>{869c0a82-1d39-6a5e-8690-000000007702}</Data><Data Name='ParentProcessId'>2680</Data><Data Name='ParentImage'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe</Data><Data Name='ParentCommandLine'>C:\Users\Administrator\Desktop\redpy\Scripts\python.exe C:\Users\Administrator\Desktop\redpy\Lib\site-packages\pip\__pip-runner__.py install --ignore-installed --no-user --prefix C:\Users\Administrator\AppData\Local\Temp\2\pip-build-env-bdqrqxas\overlay --no-warn-script-location --disable-pip-version-check --no-compile --target "" --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools&gt;=40.8.0</Data><Data Name='ParentUser'>EC2AMAZ-CEMU0P7\Administrator</Data></EventData></Event>

datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: e5a0e812-8fdd-4aea-ae7a-a8f99e5e7c5e
+date: '2026-07-23'
+description: Generated datasets for Python PYTHONPATH environment variable modification in attack range.
+environment: attack_range
+directory: python_pythonpath_modification
+mitre_technique:
+- T1574.007
+datasets:
+- name: python_pythonpath_modification.log
+  path: /datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'