Windows Process Creation: Python Executed with the -c Inline Code Flag

title: "Windows Process Creation: Python Executed with the -c Inline Code Flag"
id: dda871ad-e7cc-4bb3-a624-a252affa711c
status: test
description: This rule identifies process creation events where a Python interpreter executable is invoked with the -c option to execute inline Python code. Attackers can use this capability to run arbitrary code immediately from the command line, which can support malicious scripting and payload staging. The detection relies on Windows process creation telemetry, matching python.exe variants and requiring the command line to contain the -c flag while excluding known baseline and development/tooling parent contexts.
references:
  - https://docs.python.org/3/using/cmdline.html#cmdoption-c
  - https://www.revshells.com/
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
modified: 2025-10-07
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: python.exe
    - Image|endswith:
        - python.exe
        - python3.exe
        - python2.exe
  selection_cli:
    CommandLine|contains: " -c"
  filter_main_python_1:
    ParentImage|startswith:
      - C:\Program Files\Python
      - C:\Program Files (x86)\Python
    ParentImage|endswith: \python.exe
    ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip
  filter_main_python_trace:
    ParentImage|startswith:
      - C:\Program Files\Python
      - C:\Program Files (x86)\Python
    CommandLine|contains|all:
      - -W ignore::DeprecationWarning
      - "['install', '--no-cache-dir', '--no-index', '--find-links',"
      - "'--upgrade', 'pip'"
  filter_optional_vscode:
    - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
    - ParentImage:
        - C:\Program Files\Microsoft VS Code\Code.exe
        - C:\Program Files (x86)\Microsoft VS Code\Code.exe
  filter_optional_pip:
    CommandLine|contains|all:
      - <pip-setuptools-caller>
      - exec(compile(
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Python libraries that use a flag starting with "-c". Filter according to your environment
level: medium
license: DRL-1.1
related:
  - id: 899133d5-4d7c-4a7f-94ee-27355c879d90
    type: derived