Sigma rule: Shell Spawned by Celery Worker Process

Rule

Title

Shell Spawned by Celery Worker Process

Status

experimental

Level

medium

Author

Jennifer Batina

Date

2026-10-17

File

rules/linux/process_creation/proc_creation_lnx_celery_worker_shell_spawn.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a system shell interpreter being spawned directly by a Celery worker process.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

Log source

product

linux

category

process_creation

Detection

selection_img:
    Image|endswith:
        - '/ash'
        - '/bash'
        - '/busybox'
        - '/csh'
        - '/dash'
        - '/fish'
        - '/ksh'
        - '/sh'
        - '/tcsh'
        - '/zsh'
    ParentCommandLine|contains: 'celery'
selection_parent:
    - ParentImage|endswith:
          - '/python'
          - '/python3'
    - ParentImage|contains: '/python3.'
condition: all of selection_*

False positives (as the rule lists them)

• Legacy or custom administrative tasks deliberately hardcoded with shell=True or os.system execution inside Celery task functions.
• Media processing, deployment, or reporting pipelines that intentionally shell out to external tools (e.g. ffmpeg, git) from within a task.

Tags

• attack.execution
• attack.t1059.004

MITRE ATT&CK ids this rule names

• T1059.004

References

• https://docs.celeryq.dev/en/stable/userguide/tasks.html
• https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• https://labs.cloudsecurityalliance.org/research/csa-research-note-promptware-c2-agent-exploitation-20260406/
• https://nvd.nist.gov/vuln/detail/CVE-2021-23727
• https://owasp.org/www-project-top-10-for-large-language-model-applications/
• https://security.snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
• https://snyk.io/blog/python-rce-vulnerability/
• https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
• https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_celery_worker_shell_spawn.yml