Linux Python Reverse Shell via PTY and Socket Imports

Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.

FreeUnreviewedSigmahighv1

linux-python-reverse-shell-via-pty-and-socket-imports-32e62bc7

title: Linux Python Reverse Shell via PTY and Socket Imports
id: 944b9985-0131-4030-a250-6857d1b6b353
related:
  - id: c4042d54-110d-45dd-a0e1-05c47822c937
    type: similar
  - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0
    type: derived
status: test
description: This rule flags Linux process executions where the command line contains a Python one-liner that imports and uses both pty and socket modules, along with spawn and .connect behavior. Such patterns are commonly used to establish a network connection and attach or spawn an interactive shell over that channel. It relies on process creation telemetry with the full Image and CommandLine fields to match the presence of these specific strings in the Python -c payload.
references:
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml
author: "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2023-04-24
modified: 2024-11-04
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: python
    CommandLine|contains|all:
      - " -c "
      - import
      - pty
      - socket
      - spawn
      - .connect
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Linux process executions where the command line contains a Python one-liner that imports and uses both pty and socket modules, along with spawn and .connect behavior. Such patterns are commonly used to establish a network connection and attach or spawn an interactive shell over that channel. It relies on process creation telemetry with the full Image and CommandLine fields to match the presence of these specific strings in the Python -c payload.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.