Suspicious Execution of Python WebServer - Linux (via process_creation)

title: Suspicious Execution of Python WebServer - Linux (via process_creation)
id: 28975fdf-f693-5391-9127-b1d58084a15b
status: stable
description: This rule detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, threat actors may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software. This method is frequently used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
references:
    - https://attack.mitre.org/techniques/T1048/003/
    - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
    - https://docs.python.org/3/library/http.server.html
    - https://docs.python.org/2/library/simplehttpserver.html
author: Huntrule Team
date: 2026-07-02
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        - Image|endswith:
              - '/python'
              - '/python2'
              - '/python3'
        - Image|contains:
              - '/python2.'
              - '/python3.'
    selection_module:
        CommandLine|contains:
            - 'http.server'
            - 'SimpleHTTPServer'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium