← Back to SOC feed Coverage →

python-based-attacks-on-macos

kql MEDIUM Azure-Sentinel
DeviceProcessEvents
exploithuntingmicrosoftofficialpowershell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-20T23:00:01Z · Confidence: medium

Hunt Hypothesis

Adversaries may leverage Python, a pre-installed language on macOS, to execute malicious scripts and establish persistence. SOC teams should proactively hunt for this behavior to detect and mitigate potential Python-based attacks that exploit the native language environment.

KQL Query

DeviceProcessEvents
| where InitiatingProcessParentFileName in ("Microsoft Word", "Microsoft Excel")
| where FileName =~ "Python"
| where ProcessCommandLine matches regex "[A-Za-z0-9]{50}"

Analytic Rule Definition

id: 5a227ae6-1f40-499a-a4cc-6f6a0cc4d286
name: python-based-attacks-on-macos
description: |
  This query was originally published in the threat analytics report, Python abuse on macOS
  The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
  The following query checks for Microsoft Office documents that run Python scripts.
  Reference - https://www.powershellempire.com/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where InitiatingProcessParentFileName in ("Microsoft Word", "Microsoft Excel")
  | where FileName =~ "Python"
  | where ProcessCommandLine matches regex "[A-Za-z0-9]{50}"

Required Data Sources

Sentinel TableNotes
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/python-based-attacks-on-macos.yaml