Linux Inline Python (-c) Calls os.system to Spawn Shell

title: Linux Inline Python (-c) Calls os.system to Spawn Shell
id: 3e2f10aa-c1a8-462a-88e4-1d01242c6978
status: test
description: This rule identifies Linux process creation where inline Python execution is used via the "-c" argument, and the code calls os.system( to run a shell binary such as /bin/bash, /bin/sh, or /bin/zsh. Attackers use this pattern to execute arbitrary commands without dropping a standalone script file. The detection relies on process creation telemetry including the Python image path and command-line contents reflecting both the inline code and the targeted shell paths.
references:
  - https://gtfobins.github.io/gtfobins/python/#shell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    - Image|endswith:
        - /python
        - /python2
        - /python3
    - Image|contains:
        - /python2.
        - /python3.
  selection_cli:
    CommandLine|contains|all:
      - " -c "
      - os.system(
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc
    type: derived