← Back to SOC feed Coverage →

python-use-by-ransomware-macos

kql MEDIUM Azure-Sentinel
DeviceFileEventsDeviceProcessEvents
backdoorhuntingmicrosoftofficialransomware
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-07T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use Python scripts to execute ransomware payloads on macOS systems, leveraging the language’s common presence to evade detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate emerging macOS ransomware threats before they encrypt critical data.

KQL Query

union DeviceFileEvents, DeviceProcessEvents  
| where Timestamp >= ago(7d)  
| where ProcessCommandLine contains "EIKKEIKK" and ProcessCommandLine contains "python"

Analytic Rule Definition

id: 8d52dce6-6143-44e9-8ff5-a62f2df742b2
name: python-use-by-ransomware-macos
description: |
  This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
  As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
  The query below can help locate an attempt to run Python in service of malicious activity by a remote operator. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
  Other queries related to EvilQuest ransomware can be found under the See also section below.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceProcessEvents
tactics:
- Execution
- Command and control
query: |
  union DeviceFileEvents, DeviceProcessEvents  
  | where Timestamp >= ago(7d)  
  | where ProcessCommandLine contains "EIKKEIKK" and ProcessCommandLine contains "python"

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Command and Control/python-use-by-ransomware-macos.yaml