{"id":"3f0f5957-04f8-4792-ad89-192b0303bde6","title":"Python WebServer Execution - Linux","description":"Detects the execution of Python web servers via command line interface (CLI).\nAfter gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.\nThis technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.\n","author":"Mohamed LAKRI","status":"experimental","level":"medium","date":"2025-10-17","modified":"","tags":["attack.exfiltration","attack.t1048.003"],"technique_ids":["T1048.003"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Testing or development activity"],"references":["https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver","https://docs.python.org/3/library/http.server.html","https://docs.python.org/2/library/simplehttpserver.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml","source_sha256":"f91fbaf8d266161457dfbd245189bcda83b7e3c4046250d257cd337de71a414e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Python WebServer Execution - Linux\nid: 3f0f5957-04f8-4792-ad89-192b0303bde6\nstatus: experimental\ndescription: |\n    Detects the execution of Python web servers via command line interface (CLI).\n    After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.\n    This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.\nreferences:\n    - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver\n    - https://docs.python.org/3/library/http.server.html\n    - https://docs.python.org/2/library/simplehttpserver.html\nauthor: Mohamed LAKRI\ndate: 2025-10-17\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '/python'\n              - '/python2'\n              - '/python3'\n        - Image|contains:\n              - '/python2.'  # python image is always of the form ../python3.10; ../python is just a symlink\n              - '/python3.'\n    selection_module:\n        CommandLine|contains:\n            - 'http.server'\n            - 'SimpleHTTPServer'\n    condition: all of selection_*\nfalsepositives:\n    - Testing or development activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/enterprise/T1048.003/"}],"data_path":"data/detection-rules/3f0f5957-04f8-4792-ad89-192b0303bde6.json","kind":"sigma"}