Linux: System Shell Spawned by Celery Worker Python Process

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where a system shell interpreter (e.g., sh/bash/dash/busybox variants) is spawned directly by a Celery-related worker process. Such direct shell execution from a Python/Celery task can indicate unsafe handling of task input leading to command execution. The detection relies on Linux process creation telemetry, matching shell executable paths and parent process image/command line details indicating Celery and Python origins.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Suspicious F5 Appliance Reconnaissance Commands

Possible Shellshock Bash Function Definition Injection via Process Creation

Malicious React Server Component RCE via Node Web Process Spawning Shell (via process_creation)

Suspicious Base64 Decoding Piped to Shell on macOS

Suspicious Hex Decoding Piped to Shell via xxd on macOS

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

Malicious Reverse Shell via Netcat or Shell Redirection on Linux (via process_creation)

Malicious Reverse Shell Spawned from Oracle EBS Java Process

Malicious Bash Reverse Shell via /dev/tcp

Linux: System Shell Spawned by Celery Worker Python Process

Pivot detection · T1059.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-system-shell-spawned-by-celery-worker-python-process-904f6442

title: "Linux: System Shell Spawned by Celery Worker Python Process"
id: ae77f69c-b5e0-4abc-b102-acfa72fbcb87
status: experimental
description: This rule identifies process creation events where a system shell interpreter (e.g., sh/bash/dash/busybox variants) is spawned directly by a Celery-related worker process. Such direct shell execution from a Python/Celery task can indicate unsafe handling of task input leading to command execution. The detection relies on Linux process creation telemetry, matching shell executable paths and parent process image/command line details indicating Celery and Python origins.
references:
  - https://docs.celeryq.dev/en/stable/userguide/tasks.html
  - https://genai.owasp.org/llmrisk/llm01-prompt-injection/
  - https://labs.cloudsecurityalliance.org/research/csa-research-note-promptware-c2-agent-exploitation-20260406/
  - https://nvd.nist.gov/vuln/detail/CVE-2021-23727
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
  - https://security.snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
  - https://snyk.io/blog/python-rce-vulnerability/
  - https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
  - https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_celery_worker_shell_spawn.yml
author: Jennifer Batina, Huntrule Team
date: 2026-10-17
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /ash
      - /bash
      - /busybox
      - /csh
      - /dash
      - /fish
      - /ksh
      - /sh
      - /tcsh
      - /zsh
    ParentCommandLine|contains: celery
  selection_parent:
    - ParentImage|endswith:
        - /python
        - /python3
    - ParentImage|contains: /python3.
  condition: all of selection_*
falsepositives:
  - Legacy or custom administrative tasks deliberately hardcoded with shell=True or os.system execution inside Celery task functions.
  - Media processing, deployment, or reporting pipelines that intentionally shell out to external tools (e.g. ffmpeg, git) from within a task.
level: medium
license: DRL-1.1
related:
  - id: 904f6442-3b57-4b3f-987c-1559f58ce8d8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL