Windows Process Creation: Python Executed with the -c Inline Code Flag
Flags Windows executions of python.exe with -c inline code, excluding common installer/baseline and VS Code contexts.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-02
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where a Python interpreter executable is invoked with the -c option to execute inline Python code. Attackers can use this capability to run arbitrary code immediately from the command line, which can support malicious scripting and payload staging. The detection relies on Windows process creation telemetry, matching python.exe variants and requiring the command line to contain the -c flag while excluding known baseline and development/tooling parent contexts.
Reporting behind it
- docs.python.orghttps://docs.python.org/3/using/cmdline.html#cmdoption-c
- revshells.comhttps://www.revshells.com/
- pentestmonkey.nethttps://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Python Executed with the -c Inline Code Flag"
id: dda871ad-e7cc-4bb3-a624-a252affa711c
status: test
description: This rule identifies process creation events where a Python interpreter executable is invoked with the -c option to execute inline Python code. Attackers can use this capability to run arbitrary code immediately from the command line, which can support malicious scripting and payload staging. The detection relies on Windows process creation telemetry, matching python.exe variants and requiring the command line to contain the -c flag while excluding known baseline and development/tooling parent contexts.
references:
- https://docs.python.org/3/using/cmdline.html#cmdoption-c
- https://www.revshells.com/
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
modified: 2025-10-07
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: python.exe
- Image|endswith:
- python.exe
- python3.exe
- python2.exe
selection_cli:
CommandLine|contains: " -c"
filter_main_python_1:
ParentImage|startswith:
- C:\Program Files\Python
- C:\Program Files (x86)\Python
ParentImage|endswith: \python.exe
ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip
filter_main_python_trace:
ParentImage|startswith:
- C:\Program Files\Python
- C:\Program Files (x86)\Python
CommandLine|contains|all:
- -W ignore::DeprecationWarning
- "['install', '--no-cache-dir', '--no-index', '--find-links',"
- "'--upgrade', 'pip'"
filter_optional_vscode:
- ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
- ParentImage:
- C:\Program Files\Microsoft VS Code\Code.exe
- C:\Program Files (x86)\Microsoft VS Code\Code.exe
filter_optional_pip:
CommandLine|contains|all:
- <pip-setuptools-caller>
- exec(compile(
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Python libraries that use a flag starting with "-c". Filter according to your environment
level: medium
license: DRL-1.1
related:
- id: 899133d5-4d7c-4a7f-94ee-27355c879d90
type: derived