Suspicious Python Command Execution
Description
This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments include operations to execute code, create subprocesses, and encode or decode data.
Query · eql
process where event.type == "start" and event.action == "exec" and process.name like "python*" and
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args == "-c" and (
(
process.command_line like~ ("*import *os;*", "*import *os,*", "*import *pty;*", "*import *pty,*") and
process.command_line like~ ("*os.system*", "*os.setuid*", "*os.dup2*", "*pty*", "*os.popen(*")
) or
(
process.command_line like~ ("*import *socket;*", "*import *socket,*") and
process.command_line like~ ("*.connect(*", "*os.getenv*", "*os.dup2*", "*socket.socket(*", "*.bind(*") and
process.command_line like~ "*/bin/*sh*"
) or
(
process.command_line like~ ("*import *subprocess*;", "*import *subprocess,*") and
process.command_line like~ "*subprocess.call*"
) or
(
process.command_line like~ ("*base64*", "*binascii*", "*zlib*", "*gzip*", "*bz2*", "*lzma*", "*marshal.loads(*", "*pickle.loads(*") and
process.command_line like~ ("*exec(*", "*eval(*")
) or
(
process.command_line like~ "*import *wave*" and
process.command_line like~ "*wave.open*" and
process.command_line like~ "*readframes*" and
process.command_line like~ ("*exec(*", "*eval(*")
)
) and process.working_directory like (
"/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
) and not (
process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init", "/dockerstartup/custom_startup.sh") or
process.parent.args like "/home/*/bin/join-zoom.sh" or
process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
process.command_line like (
"/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
"/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
"python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
"*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
"""/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
"python3*os.system*echo test*", "python3 -c import pymysql*",
"python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
"import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
"import sys;sys.path=[p for p in sys.path if p];import binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
"*Thomas Nagy*", "*/tmp/claude-*",
"/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
) or
process.parent.executable like~ (
"/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
"/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
"/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
"/usr/lib/openssh/sshd-session", "/usr/libexec/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled", "/home/*/.local/bin/kiro-cli-chat"
) or
process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
process.working_directory like~ (
"/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
"/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
"/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
"/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
"/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
) or
process.parent.command_line like~ (
"/nix/store/*pytest*", "*/home/*/.claude/shell-snapshots/*", "*vault/core/test_hub/resources/events_checksum_monitor/bucket/verifier_test.go*",
"*__CURSOR_SANDBOX_ENV_RESTORE*"
) or
process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
(process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
(process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
(
process.parent.executable == "/usr/libexec/openssh/sshd-session" and
process.command_line like "/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
) or
(
process.executable in ("/bin/python2", "/usr/bin/python2") and
process.command_line like (
"*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
)
)
)