Query: write Sigma for Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv
Matching passage: Sigma rule: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv. Logsource: windows / process_creation. Rule: title: Python Inline Command Execution id: 899133d5-4d7c-4a7f-94ee-27355c879d90 status: test description: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code. references: - https://docs.python.org/3/using/cmdline.html#cmdoption-c - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-10-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: python.exe - Image|endswith: - python.exe - python3.exe - python2.exe selection_cli: CommandLine|contains: ' -c' filter_main_python_1: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python ParentImage|endswith: \python.exe ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip filter_main_python_trace: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python CommandLine|contains|all: - -W ignore::DeprecationWarning - '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'',' - '''--upgrade'', ''pip''' filter_optional_vscode: - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe - ParentImage: - C:\Program Files\Microsoft VS Code\Code.exe - C:\Program Files (x86)\Microsoft VS Code\Code.exe filter_optional_pip: CommandLine|contains|all: - <pip-setuptools-caller> - exec(compile( condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Python libraries that use a flag starting with "-c". Filter according to your environment level: medium
Near-miss passage: Sigma rule: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.. Logsource: macos / process_creation. Rule: title: Launch Agent/Daemon Execution Via Launchctl id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e status: test description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html - https://www.loobins.io/binaries/launchctl/ author: Pratinav Chandra date: 2024-05-13 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1569.001 - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /launchctl CommandLine|contains: - submit - load - start condition: selection falsepositives: - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious. level: medium