Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
Flags Linux processes running Python’s built-in HTTP server modules via command line.
- Product
- linux
- Category
- process_creation
- Author
- Mohamed LAKRI (SigmaHQ), DRL 1.1
- Published
- 2025-10-17
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Impact
What it detects
This rule identifies process creation on Linux where a Python interpreter is executed and the command line references Python’s built-in web server components such as http.server or SimpleHTTPServer. Attackers may use these modules post-compromise to quickly spin up an HTTP service without deploying additional software, often to facilitate transfer of files or content between systems. The detection relies on process creation telemetry including the executed image path and the command-line arguments.
Reporting behind it
- atomicredteam.iohttps://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
- docs.python.orghttps://docs.python.org/3/library/http.server.html
- docs.python.orghttps://docs.python.org/2/library/simplehttpserver.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
id: 04deddc5-ed8f-429e-bae4-549c819aafc9
status: experimental
description: This rule identifies process creation on Linux where a Python interpreter is executed and the command line references Python’s built-in web server components such as http.server or SimpleHTTPServer. Attackers may use these modules post-compromise to quickly spin up an HTTP service without deploying additional software, often to facilitate transfer of files or content between systems. The detection relies on process creation telemetry including the executed image path and the command-line arguments.
references:
- https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
- https://docs.python.org/3/library/http.server.html
- https://docs.python.org/2/library/simplehttpserver.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml
author: Mohamed LAKRI, Huntrule Team
date: 2025-10-17
tags:
- attack.exfiltration
- attack.t1048.003
logsource:
product: linux
category: process_creation
detection:
selection_img:
- Image|endswith:
- /python
- /python2
- /python3
- Image|contains:
- /python2.
- /python3.
selection_module:
CommandLine|contains:
- http.server
- SimpleHTTPServer
condition: all of selection_*
falsepositives:
- Testing or development activity
level: medium
license: DRL-1.1
related:
- id: 3f0f5957-04f8-4792-ad89-192b0303bde6
type: derived