Python Inline Command Execution

Title: Python Inline Command Execution
Status: test
Description:Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
References:
  -https://docs.python.org/3/using/cmdline.html#cmdoption-c
  -https://www.revshells.com/
  -https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
modified:2025-10-07
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'python.exe'     - Image|endswith:
      - 'python.exe'
      - 'python3.exe'
      - 'python2.exe'
  selection_cli:
    CommandLine|contains: ' -c'
  filter_main_python_1:
    ParentImage|startswith:
      -'C:\Program Files\Python'
      -'C:\Program Files (x86)\Python'

    ParentImage|endswith: '\python.exe'
    ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
  filter_main_python_trace:
    ParentImage|startswith:
      -'C:\Program Files\Python'
      -'C:\Program Files (x86)\Python'

    CommandLine|contains|all:
      -'-W ignore::DeprecationWarning'
      -'['install', '--no-cache-dir', '--no-index', '--find-links','
      -''--upgrade', 'pip''

  filter_optional_vscode:
ParentImage|endswith:'\AppData\Local\Programs\Microsoft VS Code\Code.exe'     - ParentImage:
      - 'C:\Program Files\Microsoft VS Code\Code.exe'
      - 'C:\Program Files (x86)\Microsoft VS Code\Code.exe'
  filter_optional_pip:
    CommandLine|contains|all:
      -'<pip-setuptools-caller>'
      -'exec(compile('

  condition:all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Python libraries that use a flag starting with "-c". Filter according to your environment
Level: medium