# Python Download and Execute Remote Code

- **Severity:** Critical
- **Signature ID:** `5e6a3d2e-0983-5e22-9fb1-6cfc27baa291`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while avoiding detections that only watch for curl or wget downloads.

## How the attack works

An attacker gets a Python process to run, either through a compromised script, a vulnerable application, or an agent with code execution ability. That Python code uses a library such as urllib, requests, or httpx to fetch content from a remote server. Instead of writing the response to a file, the code passes it directly to exec or eval, or uses it as a dynamic import, so the fetched code runs immediately in memory. This avoids leaving a downloaded file on disk and sidesteps detections built around command-line tools like curl or wget.

## Why it matters

If successful, an attacker gets arbitrary code execution on the host running the Python process, with no file artifact to inspect afterward. This can lead to further compromise, credential theft, or lateral movement depending on what that process has access to.

## What you can do

- Review any code that combines a network request with exec, eval, or dynamic import, and confirm the source URL is trusted and controlled internally.
- Restrict outbound network access from application servers and agent runtimes to a known allowlist of domains.
- Log and alert on Python processes making outbound HTTP requests to external hosts, especially followed by unusual child process or module-loading activity.
- Where dynamic plugin loading is a legitimate business need, pin it to internal registries only and require signed or checksummed payloads.

## Known benign look-alikes

- Dynamic plugin systems that fetch and execute approved code modules from internal registries
- Interactive Python notebooks that download and run trusted analysis scripts from internal URLs

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1105/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/python-download-exec