Python Inline Command Execution

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: python.exe
Image|endswith: python2.exe
Image|endswith: python3.exe
OriginalFileName: python.exe

Stage 2: `all of selection_cli`

CommandLine|contains: ' -c'

Stage 3: `not 1 of filter_main_*`

or:
or:
ParentImage|startswith: 'C:\Program Files (x86)\Python'
ParentImage|startswith: 'C:\Program Files\Python'
CommandLine|contains: '--upgrade', 'pip'
CommandLine|contains: '-W ignore::DeprecationWarning'
CommandLine|contains: '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'','
or:
ParentImage|startswith: 'C:\Program Files (x86)\Python'
ParentImage|startswith: 'C:\Program Files\Python'
ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
ParentImage|endswith: '\python.exe'

Stage 4: `not 1 of filter_optional_*`

or:
CommandLine|contains: '<pip-setuptools-caller>'
CommandLine|contains: 'exec(compile('
ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
ParentImage: 'C:\Program Files (x86)\Microsoft VS Code\Code.exe'
ParentImage: 'C:\Program Files\Microsoft VS Code\Code.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-c` corpus 4 (sigma 4) `'--upgrade', 'pip'` `-W ignore::DeprecationWarning` `<pip-setuptools-caller>` `['install', '--no-cache-dir', '--no-index', '--find-links',` `exec(compile(`
`Image`	ends_with	`python.exe` corpus 2 (sigma 2) `python2.exe` corpus 2 (sigma 2) `python3.exe` corpus 2 (sigma 2)
`OriginalFileName`	eq	`python.exe`
`ParentCommandLine`	match	`-E -s -m ensurepip -U --default-pip`
`ParentImage`	ends_with	`\AppData\Local\Programs\Microsoft VS Code\Code.exe` corpus 2 (sigma 2) `\python.exe` corpus 2 (sigma 2)
`ParentImage`	eq	`C:\Program Files (x86)\Microsoft VS Code\Code.exe` `C:\Program Files\Microsoft VS Code\Code.exe`
`ParentImage`	starts_with	`C:\Program Files (x86)\Python` `C:\Program Files\Python`

Python Inline Command Execution

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_img

Stage 2: all of selection_cli

Stage 3: not 1 of filter_main_*

Stage 4: not 1 of filter_optional_*

Indicators

Stage 1: `all of selection_img`

Stage 2: `all of selection_cli`

Stage 3: `not 1 of filter_main_*`

Stage 4: `not 1 of filter_optional_*`