huntrule

Linux: System Shell Spawned by Celery Worker Python Process

Flags Linux instances where a Celery worker’s Python process spawns a system shell interpreter.

FreeReviewedSigma · Medium · v1
Product
linux
Category
process_creation
Author
Jennifer Batina (SigmaHQ), DRL 1.1
Published
2026-10-17
Updated
2026-10-17
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process creation events where a system shell interpreter (e.g., sh/bash/dash/busybox variants) is spawned directly by a Celery-related worker process. Such direct shell execution from a Python/Celery task can indicate unsafe handling of task input leading to command execution. The detection relies on Linux process creation telemetry, matching shell executable paths and parent process image/command line details indicating Celery and Python origins.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Suspicious F5 Appliance Reconnaissance Commands
Possible Shellshock Bash Function Definition Injection via Process Creation
Malicious React Server Component RCE via Node Web Process Spawning Shell (via process_creation)
Suspicious Base64 Decoding Piped to Shell on macOS
Suspicious Hex Decoding Piped to Shell via xxd on macOS
Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)
Malicious Reverse Shell via Netcat or Shell Redirection on Linux (via process_creation)
Malicious Reverse Shell Spawned from Oracle EBS Java Process
Malicious Bash Reverse Shell via /dev/tcp
Linux: System Shell Spawned by Celery Worker Python Process
Pivot detection · T1059.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.