Query: detect Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv in logs
Matching passage: Sigma rule: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv. Logsource: windows / process_creation. Rule: title: Python Inline Command Execution id: 899133d5-4d7c-4a7f-94ee-27355c879d90 status: test description: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code. references: - https://docs.python.org/3/using/cmdline.html#cmdoption-c - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-10-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: python.exe - Image|endswith: - python.exe - python3.exe - python2.exe selection_cli: CommandLine|contains: ' -c' filter_main_python_1: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python ParentImage|endswith: \python.exe ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip filter_main_python_trace: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python CommandLine|contains|all: - -W ignore::DeprecationWarning - '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'',' - '''--upgrade'', ''pip''' filter_optional_vscode: - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe - ParentImage: - C:\Program Files\Microsoft VS Code\Code.exe - C:\Program Files (x86)\Microsoft VS Code\Code.exe filter_optional_pip: CommandLine|contains|all: - <pip-setuptools-caller> - exec(compile( condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Python libraries that use a flag starting with "-c". Filter according to your environment level: medium
Near-miss passage: Sigma rule: Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware mi. Logsource: linux / auditd. Rule: title: Special File Creation via Mknod Syscall id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e status: experimental description: 'Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors. ' references: - https://man7.org/linux/man-pages/man2/mknod.2.html - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8 author: Milad Cheraghi date: 2025-05-31 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: product: linux service: auditd detection: selection: type: SYSCALL SYSCALL: mknod condition: selection falsepositives: - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV) - Container runtimes or security tools during initialization level: low