[New Rule] Python Site or User Customize File Creation

[Aegrah]

Summary

This rule detects the creation and modification of sitecustomize.py and usercustomize.py, which Python automatically executes on startup. Attackers can exploit these files for persistence by injecting malicious code. The rule monitors system-wide, user-specific, and virtual environment locations to catch unauthorized changes that could indicate persistence or backdooring attempts.

Telemetry

0 hits in telemetry last 90d.

[tradebot-elastic]

⛔️ Tests failed:

• ❌ Python Site or User Customize File Creation (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[terrancedejesus]

Good consideration by Jon.
Other than that, LGTM

[tradebot-elastic]

⛔️ Tests failed:

[DefSecSentinel]

LGTM

[tradebot-elastic]

⛔️ Tests failed:

[tradebot-elastic]

⛔️ Tests failed:

• ❌ Python Site or User Customize File Creation (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
  • events_validation_missing: Not tested with events

[Aegrah]

Due to the effort required to find/test all usercustomize.py/sitecustomize.py creation paths for Windows/macOS, I will not be adding support to these platforms. I created an issue to track this, in case a maintainer from these platforms wants to tackle this. For now, I will just merge the PR for Linux only. cc @w0rk3r @DefSecSentinel. Issue: #4505

[tradebot-elastic]

⛔️ Tests failed:

• ❌ Python Site or User Customize File Creation (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
  • events_validation_missing: Not tested with events