Linux Python Reverse Shell via pty and socket Module Execution
Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-24
- Updated
- 2026-07-31
What it detects
This rule identifies Linux process executions where the command line invokes Python with inline code that imports the pty and socket modules and then uses connection and spawn-related functions. Such behavior is significant because it can be used to establish outbound connectivity and create a pseudo-terminal for interactive remote control. Telemetry relies on process creation events with the executable path and command-line arguments containing the relevant Python -c code fragments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Python Reverse Shell via pty and socket Module Execution
id: 944b9985-0131-4030-a250-6857d1b6b353
related:
- id: c4042d54-110d-45dd-a0e1-05c47822c937
type: similar
- id: 32e62bc7-3de0-4bb1-90af-532978fe42c0
type: derived
status: test
description: This rule identifies Linux process executions where the command line invokes Python with inline code that imports the pty and socket modules and then uses connection and spawn-related functions. Such behavior is significant because it can be used to establish outbound connectivity and create a pseudo-terminal for interactive remote control. Telemetry relies on process creation events with the executable path and command-line arguments containing the relevant Python -c code fragments.
references:
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml
author: "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2023-04-24
modified: 2024-11-04
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|contains: python
CommandLine|contains|all:
- " -c "
- import
- pty
- socket
- spawn
- .connect
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1