Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Flags Linux processes running Python’s built-in HTTP server modules via command line.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Mohamed LAKRI (SigmaHQ), DRL 1.1
Published: 2025-10-17
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule identifies process creation on Linux where a Python interpreter is executed and the command line references Python’s built-in web server components such as http.server or SimpleHTTPServer. Attackers may use these modules post-compromise to quickly spin up an HTTP service without deploying additional software, often to facilitate transfer of files or content between systems. The detection relies on process creation telemetry including the executed image path and the command-line arguments.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Linux wget POST-file Usage Indicating Data Exfiltration

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Pivot detection · T1048.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-python-http-server-execution-via-command-line-http-server-simplehttpserver-3f0f5957

title: Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
id: 04deddc5-ed8f-429e-bae4-549c819aafc9
status: experimental
description: This rule identifies process creation on Linux where a Python interpreter is executed and the command line references Python’s built-in web server components such as http.server or SimpleHTTPServer. Attackers may use these modules post-compromise to quickly spin up an HTTP service without deploying additional software, often to facilitate transfer of files or content between systems. The detection relies on process creation telemetry including the executed image path and the command-line arguments.
references:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
  - https://docs.python.org/3/library/http.server.html
  - https://docs.python.org/2/library/simplehttpserver.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml
author: Mohamed LAKRI, Huntrule Team
date: 2025-10-17
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - /python
        - /python2
        - /python3
    - Image|contains:
        - /python2.
        - /python3.
  selection_module:
    CommandLine|contains:
      - http.server
      - SimpleHTTPServer
  condition: all of selection_*
falsepositives:
  - Testing or development activity
level: medium
license: DRL-1.1
related:
  - id: 3f0f5957-04f8-4792-ad89-192b0303bde6
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL