Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

ROT Encoded Python Script Execution

Identifies the execution of a Python script that uses the ROT cipher for letters substitution. Adversaries may use this method to encode and obfuscate part of their malicious code in legit python packages.

ATT&CK coverage

Execution

T1059Command and Scripting Interpreter450 detections cover this technique
- T1059.006Python 50 detections cover this technique

Stealth

T1027Obfuscated Files or Information144 detections cover this technique
- T1027.013Encrypted/Encoded File 6 detections cover this technique
T1140Deobfuscate/Decode Files or Information 56 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.