Python interpreter spawned by a document or script host

Siemphony@siemphonymediumT1059.006unverified

Matches a Python interpreter process whose parent is an Office application, a script host or a signed-binary proxy, which is the lineage half of AN0172. Python itself is unremarkable on a Windows estate, so the parent list is the entire detection: it populates MITRE's ParentProcess knob, and the twelve parents named are authored here rather than taken from MITRE, which names only winword.exe and mshta.exe as examples. py.exe and pyw.exe are in the child list on purpose — the launcher execs python.exe as its own child, so in a Word-to-py.exe-to-python.exe chain only the py.exe event still carries winword.exe as ParentImage and a list of python.exe alone would miss it. Known gap in the child list: endswith cannot see version-suffixed interpreters such as python3.12.exe or the embedded runtimes some vendors ship under their own product name, so a payload launched through one of those is invisible here. MITRE's ScriptPath knob (a .py under a temp or profile directory) is not used, because on Sysmon EventID 1 the script path sits in CommandLine only when it was passed as an argument, and requiring that would drop the -c one-liner form entirely. The rule is written in the Sysmon EventID 1 vocabulary the brief names; if Security 4688 feeds this category instead, ParentProcessName is the field name there and Audit Process Creation must be enabled first. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0063, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\python.exe" or FolderPath endswith "\\pythonw.exe" or FolderPath endswith "\\python3.exe" or FolderPath endswith "\\py.exe" or FolderPath endswith "\\pyw.exe") and (InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe" or InitiatingProcessFolderPath endswith "\\outlook.exe" or InitiatingProcessFolderPath endswith "\\msaccess.exe" or InitiatingProcessFolderPath endswith "\\visio.exe" or InitiatingProcessFolderPath endswith "\\mshta.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe" or InitiatingProcessFolderPath endswith "\\regsvr32.exe" or InitiatingProcessFolderPath endswith "\\rundll32.exe" or InitiatingProcessFolderPath endswith "\\wmiprvse.exe"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\python3.exe" OR Image="*\\py.exe" OR Image="*\\pyw.exe") AND (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\msaccess.exe" OR ParentImage="*\\visio.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\regsvr32.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\wmiprvse.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python3.exe" OR TO_LOWER(process.executable) LIKE "*\\\\py.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pyw.exe") AND (TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\outlook.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msaccess.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\visio.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wmiprvse.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\python\.exe$|\\pythonw\.exe$|\\python3\.exe$|\\py\.exe$|\\pyw\.exe$)</field>    <field name="ParentImage" type="pcre2">(?i)(\\winword\.exe$|\\excel\.exe$|\\powerpnt\.exe$|\\outlook\.exe$|\\msaccess\.exe$|\\visio\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\regsvr32\.exe$|\\rundll32\.exe$|\\wmiprvse\.exe$)</field>    <description>Python interpreter spawned by a document or script host</description>    <mitre>      <id>T1059.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1995db3a-f5c0-4627-a564-aecece69fcdc

ATT&CKT1059.006

T1059.006Python

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

A Python interpreter started by a process that has no business starting one: an Office application, a Windows script host, or a signed-binary proxy. That is the lineage half of AN0172, which asks for Python execution "with anomalous parent lineage (e.g., Office macros, LOLBAS)". Python on its own is unremarkable on a Windows estate — a rule on python.exe alone would match every developer, every data-science notebook and every vendor agent that bundles a runtime. The parent list is the detection here; remove it and nothing is left.

02 · Telemetry you need

category: process_creation, product: windows — the Sysmon EventID 1 source the brief names for AN0172. The rule uses Image and ParentImage, which is Sysmon vocabulary. If your estate feeds Security EventID 4688 into the same category instead, the equivalent field is NewProcessName/ParentProcessName and a mapping is needed first, plus Audit Process Creation, which is not on by default. The rule touches only process metadata, so Script Block Logging and command-line policy are not prerequisites for this particular logic.

03 · How the logic works

Two selections ANDed. selection_python matches Image|endswith against \python.exe, \pythonw.exe, \python3.exe, \py.exe and \pyw.exe. selection_parent matches ParentImage|endswith against twelve parents: winword.exe, excel.exe, powerpnt.exe, outlook.exe, msaccess.exe, visio.exe, mshta.exe, wscript.exe, cscript.exe, regsvr32.exe, rundll32.exe and wmiprvse.exe. That list populates MITRE's ParentProcess knob — MITRE names the knob and offers winword.exe and mshta.exe as examples; the other ten are authored by this pipeline. py.exe and pyw.exe are in the child list deliberately. The launcher execs python.exe as its own child, so in a Word → py.exe → python.exe chain, only the py.exe event still carries winword.exe as ParentImage; a list of python.exe alone would miss the whole thing. The corresponding gap: endswith cannot see version-suffixed interpreters such as python3.12.exe, or embedded runtimes a vendor ships under its own binary name. MITRE's ScriptPath knob is unused, because on EID 1 the .py path appears in CommandLine only when passed as an argument, and requiring it would discard the -c one-liner form entirely.

04 · Common false positives

Excel automation add-ins that embed Python by design are the loudest source by a wide margin — xlwings, PyXLL, the Anaconda and Bloomberg integrations. On a finance or research workstation, excel.exe launching python.exe is the product working correctly, and it repeats on recalculation. Reporting and RPA add-ins in Word, Outlook and Access do the same to render documents or parse attachments. Endpoint management that runs scripts over WMI or WinRM makes wmiprvse.exe the parent of a bundled python.exe on a schedule, estate-wide. Legacy in-house automation still wrapped in .vbs keeps cscript.exe and wscript.exe in play.

05 · Detection maturity

tier_1: Lowest tier. Derived from MITRE prose and never run against a log line — the parent list, the noise ranking and the medium level are all reasoning, not measurement. Baseline in hunt mode before alerting.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Tune by pairing, not by deleting parents. Suppress the specific parent-plus-child-path combinations you can account for — excel.exe launching the interpreter inside your Anaconda install path, your RPA vendor's bundled runtime — rather than dropping excel.exe from the list, which would blind the Office-macro case the rule exists for. Then add CommandLine to your triage view: -c, -e, base64 and a URL are what separate a macro payload from a recalculation. Add version-suffixed interpreter names once you know which ship on your images.

Declared by the author

Excel automation add-ins that embed Python by design — xlwings, PyXLL, the Anaconda and Bloomberg Excel integrations — where excel.exe launching python.exe is the product working correctly; on a finance or research workstation with one of these installed this is the highest-volume match by a wide margin and repeats on every recalculation.
Word, Outlook and Access add-ins from reporting and RPA vendors that shell out to a bundled Python runtime to render a document, parse an attachment or drive a data refresh.
Endpoint management and inventory that executes scripts over WMI or WinRM, which makes wmiprvse.exe the parent of a vendor-bundled python.exe on a schedule across the whole estate.
Legacy in-house automation kept in .vbs or .js wrappers under wscript.exe or cscript.exe that call a Python helper, common where a team migrated its scripts piecemeal.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/1995db3a-f5c0-4627-a564-aecece69fcdc

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Python interpreter spawned by a document or script host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it