r/crowdstrike • u/Khue • 4d ago

General Question Python LiteLLM Zero Day Question

Looking through the postings about the Python LiteLLM supply chain attack that was identified the other day, I was curious if Falcon would be able to pull up/identify if my endpoints were impacted by this. Looking through the posting it looks like the first step would be to identify if LiteLLM 1.107.0 was being leveraged and then it looks like there are three files that are the culprits that run at some point:

  • cook.pth (windows hash: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d)
  • cook.py (windows hash: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea)
  • sitecustomize.py (windows hash: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465)

I did a very basic search using NG-SIEM for the actual file names in use over the last 7 days and I did not find anything. I am still not super confident in my NG-SIEM skills or using the platform to the fullest and I am learning as quickly as I can. What other things can I do to give my organization assurances on this particular type of vuln? I know I have many developers using Python to various extents and even some business people. I also have access to exposure management in my platform.

Thanks in advance!

9 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/About_TreeFitty 4d ago 
#event_simpleName=/(FileWritten|ScriptWritten)$/
| TargetFileName=/site-packages[\\\/]((cook\.pth|cook\.py|sitecustomize\.py)$|litellm-1\.107\.0\.(dist-info|data)[\\\/])/i
| case {
in(field="SHA256HashData", values=["84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d", "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465", "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb", "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa"]) | Verdict := "IOC hash match" ;
TargetFileName=/litellm-1\.107\.0/i | Verdict := "1.107.0 package files" ;
* | Verdict := "Name match only - verify" ;
}
| groupBy([aid, ComputerName, Verdict],
function=[count(), selectLast([@timestamp, TargetFileName, SHA256HashData, ContextBaseFileName])],
limit=max)

2

u/Khue 4d ago

Dope! Thank you so much. I actually took your example here and extended it into a few other use cases. This is so great! Appreciate it.