huntrule

Suspicious Python Reverse Shell One-Liner Execution via GlobalProtect Exploitation

PremiumReviewedSigma · High · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-11-02
Updated
2026-11-02
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a Python one-liner spawning a reverse shell via socket and subprocess as observed after GlobalProtect CVE-2024-3400 exploitation. Attackers used inline Python to obtain interactive command execution on compromised firewalls. Inline interpreter reverse shells avoid dropping files to disk.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange
Malicious Python Reverse Shell Execution on macOS
Suspicious Python Execution from Windows Store App Path
Possible Trojanised Python Native Extension Load of gradient Module
Malicious AI CLI Anti-Attribution and Permission Bypass Flags
Suspicious Python HTTP Server Staging for Payload Delivery
Suspicious Python Base64 Encoded Command Execution (via process_creation)
Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)
Malicious Python Reverse Shell One-Liner Execution (via process_creation)
Suspicious Silver Fox Backdoor Execution via pythonw appclient Module (via process_creation)
Suspicious Python Reverse Shell One-Liner Execution via GlobalProtect Exploitation
Pivot detection · T1059.006 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.