Suspicious Python Spawning Pretty TTY Through PTY Module (via process_creation)

title: Suspicious Python Spawning Pretty TTY Through PTY Module (via process_creation)
id: ebf52ec6-bc31-5184-9326-bcd88f92417a
status: stable
description: This rule detects a python process calling to the PTY module to spawn a pretty tty which could be indicative of potential reverse shell activity.
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
author: Huntrule Team
date: 2026-04-27
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        - Image|endswith:
              - '/python'
              - '/python2'
              - '/python3'
        - Image|contains:
              - '/python2.'
              - '/python3.'
    selection_cli_import:
        CommandLine|contains:
            - 'import pty'
            - 'from pty '
    selection_cli_spawn:
        CommandLine|contains: 'spawn'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium