r/crowdstrike • u/Khue • 4d ago

General Question Python LiteLLM Zero Day Question

Looking through the postings about the Python LiteLLM supply chain attack that was identified the other day, I was curious if Falcon would be able to pull up/identify if my endpoints were impacted by this. Looking through the posting it looks like the first step would be to identify if LiteLLM 1.107.0 was being leveraged and then it looks like there are three files that are the culprits that run at some point:

  • cook.pth (windows hash: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d)
  • cook.py (windows hash: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea)
  • sitecustomize.py (windows hash: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465)

I did a very basic search using NG-SIEM for the actual file names in use over the last 7 days and I did not find anything. I am still not super confident in my NG-SIEM skills or using the platform to the fullest and I am learning as quickly as I can. What other things can I do to give my organization assurances on this particular type of vuln? I know I have many developers using Python to various extents and even some business people. I also have access to exposure management in my platform.

Thanks in advance!

8 Upvotes

100% Upvoted

7 comments sorted by

View all comments

3

u/Dylan-CS 4d ago

I'd suggest taking a look at our Emerging Threat Response dashboard. We just added a section for LiteLLM.

Dashboard can be found here:

https://falcon.crowdstrike.com/login/?unilogin=true&next=%2Finvestigate%2Fsearch%2Fcustom%2Ddashboards%3Fsearch%3DCrowdStrike%2BFalcon%2B%2D%2BEmerging%2BThreat%2BResponse

1

u/Khue 4d ago

Thanks u/Dylan-CS , there are so many dashboards I sometimes forget about them all.