CyberStack

MITRE ATT&CK / Techniques / T1059.006

Command and Scripting Interpreter: Python

ID
T1059.006
Tactics
TA0002 Execution
Sub-technique of
T1059 Command and Scripting Interpreter
Platforms
ESXi, Linux, macOS, Windows
Data sources
Process Creation, Network Traffic Content, Script Execution, Command Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.[1]

Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Detection

Mitigations (4)

M1033 Limit Software Installation

Prevent users from installing Python where not required.

M1038 Execution Prevention

Denylist Python where not required.

M1047 Audit

Inventory systems for unauthorized Python installations.

M1049 Antivirus/Antimalware

Anti-virus can be used to automatically quarantine suspicious files.

Groups (21)

Software (40)

References

  1. Zscaler APT31 Covid-19 October 2020