PyPI Package Impersonation with Cryptomining Malware
This rule detects potential PyPI package impersonation attacks, specifically targeting packages that mimic 'sympy' and deliver cryptomining malware. It identifies suspicious package installation patterns, including the use of custom index URLs or extra index URLs, and the presence of specific installation flags like '--no-deps', '--no-cache-dir', or '--force-reinstall' in conjunction with 'sympy' related package names. Additionally, it looks for suspicious Python execution patterns involving code that imports, executes, or evaluates base64-encoded data, often associated with network communication libraries (urllib, requests, http.client, socket). The rule combines these indicators to identify malicious activity related to cryptomining malware delivered via PyPI.
Sigma
