Linux: Python HTTP server execution via command line (http.server/SimpleHTTPServer)

title: "Linux: Python HTTP server execution via command line (http.server/SimpleHTTPServer)"
id: 04deddc5-ed8f-429e-bae4-549c819aafc9
status: experimental
description: This rule flags process creation where the executed Python binary path includes python/python2/python3 and the command line contains Python web server module names such as http.server or SimpleHTTPServer. Attackers can use Python’s built-in HTTP servers to quickly host content and facilitate basic file transfer or staging during post-compromise activity. The detection relies on Linux process creation telemetry, specifically the process image path and the full command line.
references:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
  - https://docs.python.org/3/library/http.server.html
  - https://docs.python.org/2/library/simplehttpserver.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml
author: Mohamed LAKRI, Huntrule Team
date: 2025-10-17
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - /python
        - /python2
        - /python3
    - Image|contains:
        - /python2.
        - /python3.
  selection_module:
    CommandLine|contains:
      - http.server
      - SimpleHTTPServer
  condition: all of selection_*
falsepositives:
  - Testing or development activity
level: medium
license: DRL-1.1
related:
  - id: 3f0f5957-04f8-4792-ad89-192b0303bde6
    type: derived