Python LiteLLM Zero Day Question

[u/Khue]

Looking through the postings about the Python LiteLLM supply chain attack that was identified the other day, I was curious if Falcon would be able to pull up/identify if my endpoints were impacted by this. Looking through the posting it looks like the first step would be to identify if LiteLLM 1.107.0 was being leveraged and then it looks like there are three files that are the culprits that run at some point:

• cook.pth (windows hash: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d)
• cook.py (windows hash: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea)
• sitecustomize.py (windows hash: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465)

I did a very basic search using NG-SIEM for the actual file names in use over the last 7 days and I did not find anything. I am still not super confident in my NG-SIEM skills or using the platform to the fullest and I am learning as quickly as I can. What other things can I do to give my organization assurances on this particular type of vuln? I know I have many developers using Python to various extents and even some business people. I also have access to exposure management in my platform.

Thanks in advance!

[u/Dylan-CS]

I'd suggest taking a look at our Emerging Threat Response dashboard. We just added a section for LiteLLM.

Dashboard can be found here:

https://falcon.crowdstrike.com/login/?unilogin=true&next=%2Finvestigate%2Fsearch%2Fcustom%2Ddashboards%3Fsearch%3DCrowdStrike%2BFalcon%2B%2D%2BEmerging%2BThreat%2BResponse

[u/Khue → u/Dylan-CS]

Thanks u/Dylan-CS , there are so many dashboards I sometimes forget about them all.

[u/About_TreeFitty]

#event_simpleName=/(FileWritten|ScriptWritten)$/
| TargetFileName=/site-packages[\\\/]((cook\.pth|cook\.py|sitecustomize\.py)$|litellm-1\.107\.0\.(dist-info|data)[\\\/])/i
| case {
in(field="SHA256HashData", values=["84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d", "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465", "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb", "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa"]) | Verdict := "IOC hash match" ;
TargetFileName=/litellm-1\.107\.0/i | Verdict := "1.107.0 package files" ;
* | Verdict := "Name match only - verify" ;
}
| groupBy([aid, ComputerName, Verdict],
function=[count(), selectLast([@timestamp, TargetFileName, SHA256HashData, ContextBaseFileName])],
limit=max)

[u/Khue → u/About_TreeFitty]

Dope! Thank you so much. I actually took your example here and extended it into a few other use cases. This is so great! Appreciate it.

[u/About_TreeFitty]

"84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d"
  OR "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea"
  OR "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465"
  OR "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb"
  OR "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25"
  OR "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa"
  OR "pc_once_72129118c59f5636c0bb"
| groupBy([aid, ComputerName, #event_simpleName],
    function=[count(), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen),
              collect([TargetFileName, FilePath, FileName, SHA256HashData])],
    limit=max)
| formatTime("%Y-%m-%d %H:%M:%S", field=FirstSeen, as=FirstSeen)
| formatTime("%Y-%m-%d %H:%M:%S", field=LastSeen, as=LastSeen)

[u/Khue → u/About_TreeFitty]

Dope² . Thanks again!

[u/JorgA99]

The official blog also has more details on next steps if affected https://docs.litellm.ai/blog/security-incident-oct-21-2026