{"id":"899133d5-4d7c-4a7f-94ee-27355c879d90","title":"Python Inline Command Execution","description":"Detects execution of python using the \"-c\" flag. This is could be used as a way to launch a reverse shell or execute live python code.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-02","modified":"2025-10-07","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Python libraries that use a flag starting with \"-c\". Filter according to your environment"],"references":["https://docs.python.org/3/using/cmdline.html#cmdoption-c","https://www.revshells.com/","https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet"],"source_path":"rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml","source_sha256":"2987ca847ac2ee74b3f444d754489287e87fb3695d7752568840bc3b3dc6b2d7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Python Inline Command Execution\nid: 899133d5-4d7c-4a7f-94ee-27355c879d90\nstatus: test\ndescription: Detects execution of python using the \"-c\" flag. This is could be used as a way to launch a reverse shell or execute live python code.\nreferences:\n    - https://docs.python.org/3/using/cmdline.html#cmdoption-c\n    - https://www.revshells.com/\n    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-02\nmodified: 2025-10-07\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'python.exe'\n        - Image|endswith:\n              - 'python.exe' # no \\ bc of e.g. ipython.exe\n              - 'python3.exe'\n              - 'python2.exe'\n    selection_cli:\n        CommandLine|contains: ' -c'\n    filter_main_python_1: # Based on baseline\n        ParentImage|startswith:\n            - 'C:\\Program Files\\Python'\n            - 'C:\\Program Files (x86)\\Python'\n        ParentImage|endswith: '\\python.exe'\n        ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'\n    filter_main_python_trace: # Based on baseline\n        ParentImage|startswith:\n            - 'C:\\Program Files\\Python'\n            - 'C:\\Program Files (x86)\\Python'\n        CommandLine|contains|all:\n            # CommandLine: \\\"C:\\\\Program Files\\\\Python312\\\\python.exe\\\" -W ignore::DeprecationWarning -c \\\"\\nimport runpy\\nimport sys\\nsys.path = ['C:\\\\\\\\Users\\\\\\\\User\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\tmpdakwn6aj\\\\\\\\pip-23.2.1-py3-none-any.whl'] + sys.path\\nsys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\\\\\\\Users\\\\\\\\User\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\tmpdakwn6aj', '--upgrade', 'pip']\\nrunpy.run_module(\\\\\\\"pip\\\\\\\", run_name=\\\\\\\"__main__\\\\\\\", alter_sys=True)\\n\\\n            - '-W ignore::DeprecationWarning'\n            - \"['install', '--no-cache-dir', '--no-index', '--find-links',\"\n            - \"'--upgrade', 'pip'\"\n    filter_optional_vscode:\n        - ParentImage|endswith: '\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n        - ParentImage:\n              - 'C:\\Program Files\\Microsoft VS Code\\Code.exe'\n              - 'C:\\Program Files (x86)\\Microsoft VS Code\\Code.exe'\n    filter_optional_pip:\n        CommandLine|contains|all:\n            - '<pip-setuptools-caller>'\n            - 'exec(compile('\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Python libraries that use a flag starting with \"-c\". Filter according to your environment\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/899133d5-4d7c-4a7f-94ee-27355c879d90.json","kind":"sigma"}