Sigma rule: Python Inline Command Execution

Rule

Title

Python Inline Command Execution

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-02

Modified

2025-10-07

File

rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - OriginalFileName: 'python.exe'
    - Image|endswith:
          - 'python.exe' # no \ bc of e.g. ipython.exe
          - 'python3.exe'
          - 'python2.exe'
selection_cli:
    CommandLine|contains: ' -c'
filter_main_python_1: # Based on baseline
    ParentImage|startswith:
        - 'C:\Program Files\Python'
        - 'C:\Program Files (x86)\Python'
    ParentImage|endswith: '\python.exe'
    ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
filter_main_python_trace: # Based on baseline
    ParentImage|startswith:
        - 'C:\Program Files\Python'
        - 'C:\Program Files (x86)\Python'
    CommandLine|contains|all:
        # CommandLine: \"C:\\Program Files\\Python312\\python.exe\" -W ignore::DeprecationWarning -c \"\nimport runpy\nimport sys\nsys.path = ['C:\\\\Users\\\\User\\\\AppData\\\\Local\\\\Temp\\\\tmpdakwn6aj\\\\pip-23.2.1-py3-none-any.whl'] + sys.path\nsys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\\\Users\\\\User\\\\AppData\\\\Local\\\\Temp\\\\tmpdakwn6aj', '--upgrade', 'pip']\nrunpy.run_module(\\\"pip\\\", run_name=\\\"__main__\\\", alter_sys=True)\n\
        - '-W ignore::DeprecationWarning'
        - "['install', '--no-cache-dir', '--no-index', '--find-links',"
        - "'--upgrade', 'pip'"
filter_optional_vscode:
    - ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
    - ParentImage:
          - 'C:\Program Files\Microsoft VS Code\Code.exe'
          - 'C:\Program Files (x86)\Microsoft VS Code\Code.exe'
filter_optional_pip:
    CommandLine|contains|all:
        - '<pip-setuptools-caller>'
        - 'exec(compile('
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Python libraries that use a flag starting with "-c". Filter according to your environment

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• https://docs.python.org/3/using/cmdline.html#cmdoption-c
• https://www.revshells.com/
• https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml