Python Site Hooks Creation During Package Installation — Detection Rule
The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process. Python's `site` module loads these hooks from directories on `sys.path` before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint. The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.