---
title: Python Pickle Deserialization via Suspicious File Extension
id: 8f2c4a1b-3d5e-4f6a-9b8c-7e1d2a3b4c5d
status: experimental
description: Detects Python processes loading serialized files from suspicious locations or with network-context filenames, indicative of deserialization attacks.
references:
  - https://attack.mitre.org/techniques/T1059/006/
  - http://www.zerodayinitiative.com/advisories/ZDI-26-809/
author: Security Arsenal
date: 2026/04/03
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '.pkl'
      - '.pickle'
      - '.pt'
      - 'dft-targets'
      - 'torch.load'
      - 'pickle.load'
    CommandLine|contains:
      - 'Downloads'
      - 'Temp'
      - 'AppData\Local\Temp'
      - 'http'
  condition: all of selection
falsepositives:
  - Legitimate ML research workflows loading local model files
  - Automated training pipelines with known data sources
level: high
---
title: FAIRChem Process Spawning Unexpected Child Processes
id: 2a8f4c1d-5e6b-7a8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects FAIRChem or Python ML evaluation processes spawning shell commands or unexpected child processes, indicating successful code execution post-deserialization.
references:
  - https://attack.mitre.org/techniques/T1059/
  - http://www.zerodayinitiative.com/advisories/ZDI-26-809/
author: Security Arsenal
date: 2026/04/03
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\fairchem.exe'
    ParentCommandLine|contains:
      - 'dense_eval'
      - 'fairchem'
      - 'dft-targets'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\nc.exe'
      - '\ncat.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate post-processing scripts in research pipelines
  - Model evaluation frameworks with system integration
level: critical

// Hunt for suspicious Python deserialization patterns in process execution
let suspiciousExtensions = dynamic([".pkl", ".pickle", ".pt"]);
let suspiciousPaths = dynamic(["Downloads", "Temp", "AppData", "/tmp", "/var/tmp"]);
let suspiciousCommands = dynamic(["torch.load", "pickle.load", "joblib.load", "dill.load"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (suspiciousExtensions) or ProcessCommandLine has_any (suspiciousCommands)
| where ProcessCommandLine has_any (suspiciousPaths)
| extend FileName = tostring(split(ProcessCommandLine, " ")[0])
| extend SuspiciousFile = iif(ProcessCommandLine has_any (suspiciousExtensions), "Yes", "No")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName, SuspiciousFile, FolderPath
| sort by TimeGenerated desc

// Hunt for network connections from Python processes (potential C2 or data exfiltration)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "python")
| where InitiatingProcessCommandLine has_any ("fairchem", "dense_eval", "dft-targets", "torch.load", "pickle")
| where RemotePort in (443, 8443, 4444, 1337, 31337) or RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| sort by TimeGenerated desc

-- Hunt for suspicious Python deserialization activity and child process spawning
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime, 
       
       -- Extract parent process details for context
       (SELECT Name, CommandLine FROM pslist(pid=Pid)) as ParentInfo,
       
       -- Check for network connections
       (SELECT RemoteIP, RemotePort, Status FROM netstat(pid=Pid)) as NetworkConnections
       
FROM pslist()
WHERE 
    -- Match Python/FAIRChem processes
    (Name =~ 'python' OR Name =~ 'fairchem' OR CommandLine =~ 'fairchem' OR CommandLine =~ 'dense_eval')
    AND
    -- Match suspicious deserialization indicators
    (CommandLine =~ '\.pkl|\.pickle|\.pt|torch\.load|pickle\.load|dft-targets')
    
-- Additional hunt: Find recently created/modified serialized files in suspicious locations
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='''
    C:/Users/*/Downloads/*.pkl,
    C:/Users/*/Downloads/*.pt,
    C:/Users/*/AppData/Local/Temp/*.pkl,
    C:/Users/*/AppData/Local/Temp/*.pt,
    /tmp/*.pkl,
    /tmp/*.pt,
    /var/tmp/*.pkl,
    /var/tmp/*.pt,
    /home/*/Downloads/*.pkl,
    /home/*/Downloads/*.pt
''')
WHERE Mtime > now() - 604800  -- Last 7 days
ORDER BY Mtime DESC

#!/bin/bash
# ZDI-26-809 FAIRChem Deserialization Vulnerability — Assessment and Mitigation
# Run on research workstations, HPC login nodes, and ML pipeline servers

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_crit() { echo -e "${RED}[CRITICAL]${NC} $1"; }

# Check if FAIRChem is installed
check_fairchem_installed() {
    log_info "Checking for FAIRChem installation..."
    
    if pip show fairchem-core &>/dev/null; then
        FAIRCHEM_VERSION=$(pip show fairchem-core | grep Version | awk '{print $2}')
        log_warn "FAIRChem detected: version $FAIRCHEM_VERSION"
        return 0
    elif python3 -c "import fairchem" 2>/dev/null; then
        log_warn "FAIRChem detected via import (version check recommended)"
        return 0
    else
        log_info "FAIRChem not detected via pip or import"
        return 1
    fi
}

# Check for vulnerable pickle usage patterns in local FAIRChem
check_vulnerable_patterns() {
    log_info "Scanning for vulnerable deserialization patterns..."
    
    # Find FAIRChem installation path
    FAIRCHEM_PATH=$(python3 -c "import fairchem; print(fairchem.__file__)" 2>/dev/null | xargs dirname 2>/dev/null || echo "")
    
    if [[ -n "$FAIRCHEM_PATH" && -d "$FAIRCHEM_PATH" ]]; then
        log_info "FAIRChem path: $FAIRCHEM_PATH"
        
        # Check for dense_eval module
        if find "$FAIRCHEM_PATH" -name "*dense_eval*" -o -name "*dft*" | grep -q .; then
            log_crit "dense_eval module found — potentially vulnerable"
        fi
        
        # Check for unsafe deserialization patterns
        if grep -r "pickle.load\|torch.load\|joblib.load\|dill.load" "$FAIRCHEM_PATH" 2>/dev/null | grep -q .; then
            log_warn "Unsafe deserialization calls detected in FAIRChem codebase"
            grep -r "pickle.load\|torch.load\|joblib.load\|dill.load" "$FAIRCHEM_PATH" 2>/dev/null | head -5
        fi
    else
        log_warn "Could not locate FAIRChem installation path"
    fi
}

# Check for recently modified serialized files in user directories
scan_suspicious_files() {
    log_info "Scanning for recently modified serialized files..."
    
    SUSPICIOUS_FILES=$(find /home /tmp /var/tmp -type f \( -name "*.pkl" -o -name "*.pickle" -o -name "*.pt" \) -mtime -7 2>/dev/null || true)
    
    if [[ -n "$SUSPICIOUS_FILES" ]]; then
        log_warn "Recent serialized files found (review for legitimacy):"
        echo "$SUSPICIOUS_FILES" | head -20
        echo ""
        log_warn "Count: $(echo "$SUSPICIOUS_FILES" | wc -l) files"
    else
        log_info "No recent serialized files found in common locations"
    fi
}

# Check for FAIRChem processes with network connections
check_network_activity() {
    log_info "Checking for FAIRChem processes with network connections..."
    
    # Find Python processes running FAIRChem
    PYTHON_PIDS=$(pgrep -f "python.*fairchem\|python.*dense_eval\|python.*dft" 2>/dev/null || true)
    
    if [[ -n "$PYTHON_PIDS" ]]; then
        for pid in $PYTHON_PIDS; do
            CONNECTIONS=$(ss -tunap 2>/dev/null | grep "pid=$pid" || true)
            if [[ -n "$CONNECTIONS" ]]; then
                log_warn "Process $pid has network connections:"
                echo "$CONNECTIONS"
            fi
        done
    else
        log_info "No active FAIRChem processes detected"
    fi
}

# Hardening: Set environment variables to restrict pickle (defense-in-depth)
apply_hardening() {
    log_info "Applying defense-in-depth hardening..."
    
    # Create a sitecustomize.py to warn on pickle usage (optional, can break workflows)
    if [[ ! -f /usr/lib/python3/site-packages/sitecustomize.py ]]; then
        cat > /tmp/sitecustomize_warning.py << 'EOF'
import warnings
import sys

# Warn on pickle usage — can be enabled for high-security environments
# warnings.filterwarnings('always', category=UserWarning, message='.*pickle.*')
EOF
        log_info "Created /tmp/sitecustomize_warning.py template"
        log_info "To enable pickle warnings, copy to Python site-packages as sitecustomize.py"
    fi
    
    # Set umask for research directories (prevent world-readable model files)
    log_info "Recommended: Set umask 027 for research users to prevent accidental data exposure"
}

# Main execution
main() {
    echo "=========================================="
    echo "ZDI-26-809 FAIRChem Vulnerability Assessment"
    echo "=========================================="
    echo ""
    
    if check_fairchem_installed; then
        log_crit "FAIRChem is installed — IMMEDIATE ACTION REQUIRED"
        echo ""
        check_vulnerable_patterns
        echo ""
        scan_suspicious_files
        echo ""
        check_network_activity
        echo ""
        apply_hardening
        
        echo ""
        echo "=========================================="
        log_crit "REMEDIATION REQUIRED"
        echo "1. Check Meta FAIRChem GitHub for patched version"
        echo "2. Update: pip install --upgrade fairchem-core"
        echo "3. If no patch available, DISABLE dense_eval functionality"
        echo "4. Review all recent .pkl/.pt files for legitimacy"
        echo "5. Monitor for child process spawning from Python"
        echo "=========================================="
        exit 1
    else
        log_info "FAIRChem not detected — system not directly vulnerable"
        log_info "Consider scanning network shares and container images for FAIRChem"
        exit 0
    fi
}

main "$@"

3. **Network segmentation**: Isolate ML training clusters from general enterprise networks. Block outbound internet access from HPC compute nodes except for approved package repositories and model hubs (HuggingFace, etc.).

4. **Principle of least privilege**: Run FAIRChem with dedicated service accounts, not researcher credentials. Disable SSH key forwarding and credential caching on ML compute nodes.

### Supply Chain Controls

This vulnerability exemplifies the **AI/ML supply chain risk**. Organizations must extend traditional software composition analysis (SCA) to ML artifacts:

- **Model provenance**: Require signed models from trusted sources. Verify Sigstore/cosign signatures on model artifacts.
- **Dataset validation**: Scan datasets for embedded serialized objects before loading.
- **Pipeline isolation**: Run evaluation of untrusted models/datasets in ephemeral, isolated environments (Kubernetes Jobs, Firecracker VMs).

### CISA/Regulatory Context

While ZDI-26-809 is not yet in CISA KEV, **AI/ML security is a 2026 CISA priority**. Organizations in critical infrastructure sectors (chemical, pharmaceutical, energy) should treat this as a **KEV-equivalent urgency** given the potential for intellectual property theft and research disruption.

---

## Long-Term Defensive Strategy

The FAIRChem deserialization vulnerability is not an isolated incident — it is part of a systemic pattern in AI/ML tooling. The Python ecosystem's reliance on `pickle` for model serialization creates a **structural vulnerability class** that will persist until the ecosystem adopts safer serialization formats (Safetensors, ONNX with restrictions, or custom binary formats with strict parsers).

**Security teams should:**

1. **Inventory all ML frameworks** (PyTorch, TensorFlow, JAX, scikit-learn) and their deserialization paths
2. **Implement ML-specific EDR rules** for child process spawning, network connections from Python, and file access patterns
3. **Adopt ML-aware threat modeling** — treat model weights, training data, and evaluation scripts as attack surfaces
4. **Participate in AI/ML security communities** — the [AI Security Alliance](https://www.aisecurityalliance.org/) and [MLSecOps](https://mlsecops.com/) provide threat intelligence specific to this domain

The convergence of AI research and enterprise IT is accelerating. Vulnerabilities like ZDI-26-809 demonstrate that **research code is production code** — and must be defended accordingly.

## Related Resources

[Security Arsenal Penetration Testing Services](https://securityarsenal.com/services/penetration-testing)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[vulnerability-management Intel Hub](https://securityarsenal.com/intel/incident-response)