Suspicious Python Encoded Payload Execution

Description

Identifies Python interpreters started with -c (inline code) where the command line suggests decoding obfuscated content (e.g. base64, binascii, codecs) and then executing it via exec, eval, compile, or dynamic import. Also identifies child processes spawned by a parent Python process whose command line matches the same suspicious python -c decode-and-exec pattern, when parent telemetry is present.

Query · eql

process where event.type == "start" and event.action == "exec" and (
  (
    /* Inline malicious python -c one-liner on this process */
    process.name like ("python*", "py", "pypy*") and
    process.args == "-c" and
    process.command_line like~ (
      "*base64*", "*b64decode*", "*b32decode*", "*b85decode*", "*a85decode*", "*binascii*", "*codecs.decode*", "*fromhex*",
      "*zlib.decompress*", "*marshal.loads*", "*pickle.loads*", "*cPickle.loads*"
    ) and
    process.command_line like~ (
      "*exec(*", "*eval(*", "*__import__*", "*compile(*", "*types.FunctionType*", "*runpy*", "*importlib.util*",  "*importlib.import_module*"
    )
  ) or
  /* Child of a parent Python process running the same suspicious -c pattern (parent fields populated) */
  (
    process.parent.name like ("python*", "py", "pypy*") and
    process.parent.command_line != null and
    process.parent.args == "-c" and
    process.parent.command_line like~ (
      "*base64*", "*b64decode*", "*b32decode*", "*b85decode*", "*a85decode*", "*binascii*", "*codecs.decode*", "*fromhex*",
      "*zlib.decompress*", "*marshal.loads*"
    ) and
    process.parent.command_line like~ (
      "*exec(*", "*eval(*", "*__import__*", "*compile(*", "*types.FunctionType*", "*runpy*",
      "*importlib.util*",  "*importlib.import_module*"
    )
  )
) and
not (
  process.command_line like """*exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTbCTAR1z6GFYD93JMwLXplsVtmRI9pyg6H8fKcVrmhz8IfLxkXwimRlG5yfuggonfObn0bsGAv6aF1v3KkAPzaTegrPs6eHn/tfvJ73d3TPWQscXEWTBNhiZh6l185Qv3kwgPIweXfwbz/7YTH5BdP0cXoVMBHCE5tAMbRD0Iq5RlxXbdM5zo9DGjeVg5wF8jbwraDP5E302VKz+LDp/dCNYgqmU7Yvv4XFPZvD+2sxlJMvrEcNbIYwiryQrHBsYJ76PH+MsrwOHmHshnNiquztk9QKkpAAP0+wtHxlbROahbk/Yf+OGobZtoN6Srnnd134QZ0Ulo4Z7Y4H6RQVRvaSYsTmRkEtlrbNAemL6lXEtme4n712NShIWK2HUQtAXCp9DsJyhPQz1qN8/WHfxF3SASaRakgJUTaTBjE6/Z6Y9ZoVRPCNjVtAbD0nqrCirdECBz4elNpOxL1mx+8A7jalKCjrPQqVduUZXNwCkWQHEiIBz3VcUt/YUSYQhn8eWJkdcxKgLHAm1vJoeOIKxS68O6qDT0OfpI9CjsJ2ykmkwuziVnoYA2UacMhfiLSEy75DLOiHV9n73gwbIdDyh4tCce+zaar255IwD2DiLcs3A8IA96bUvRLNN7MbD4P4C5pEJUv6XuPqutynbV3NxTRxXJmLiJRJzmOppDjrKQoFCptb0c5blb87Ejfq8qbgWuEQ33nhN5MXViDaal0qJxK9I+ii5jMtB04y78Q9tonhI")))""" or
  process.parent.command_line like """*exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTbCTAR1z6GFYD93JMwLXplsVtmRI9pyg6H8fKcVrmhz8IfLxkXwimRlG5yfuggonfObn0bsGAv6aF1v3KkAPzaTegrPs6eHn/tfvJ73d3TPWQscXEWTBNhiZh6l185Qv3kwgPIweXfwbz/7YTH5BdP0cXoVMBHCE5tAMbRD0Iq5RlxXbdM5zo9DGjeVg5wF8jbwraDP5E302VKz+LDp/dCNYgqmU7Yvv4XFPZvD+2sxlJMvrEcNbIYwiryQrHBsYJ76PH+MsrwOHmHshnNiquztk9QKkpAAP0+wtHxlbROahbk/Yf+OGobZtoN6Srnnd134QZ0Ulo4Z7Y4H6RQVRvaSYsTmRkEtlrbNAemL6lXEtme4n712NShIWK2HUQtAXCp9DsJyhPQz1qN8/WHfxF3SASaRakgJUTaTBjE6/Z6Y9ZoVRPCNjVtAbD0nqrCirdECBz4elNpOxL1mx+8A7jalKCjrPQqVduUZXNwCkWQHEiIBz3VcUt/YUSYQhn8eWJkdcxKgLHAm1vJoeOIKxS68O6qDT0OfpI9CjsJ2ykmkwuziVnoYA2UacMhfiLSEy75DLOiHV9n73gwbIdDyh4tCce+zaar255IwD2DiLcs3A8IA96bUvRLNN7MbD4P4C5pEJUv6XuPqutynbV3NxTRxXJmLiJRJzmOppDjrKQoFCptb0c5blb87Ejfq8qbgWuEQ33nhN5MXViDaal0qJxK9I+ii5jMtB04y78Q9tonhI")))""" or
  process.parent.executable in (
    "/usr/sbin/sshd", "/usr/bin/sudo", "/usr/lib/openssh/sshd-session", "/opt/teleport/system/bin/teleport",
    "/usr/libexec/openssh/sshd-session", "/usr/bin/ansible-playbook", "/usr/bin/sort", "/usr/bin/du",
    "/usr/sbin/ldconfig.real", "/usr/sbin/runuser"
  ) or
  process.working_directory like ("/opt/zeek", "/var/lib/docker/overlay2/*/usr/local/zeek", "/usr/share/ansible") or
  process.parent.args == "/usr/local/bin/ansible-playbook" or
  process.parent.command_line like (
    "*IyBweWxpbnQ6IGRpc2FibGU9cmVzb3VyY2UtbGVha2FnZQoiIiIKVGhpcyBpcyBhIHNoaW0gdGhh*",
    "/usr/bin/python*-c import zlib,base64; exec(zlib.decompress(base64.b64decode(b*",
    "*/usr/bin/python*-c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  process.executable like (
   "/home/*/.local/share/uv/python/cpython-*/bin/python*", "/home/*/miniconda3/envs/py312a/bin/python3*"
  ) or
  process.parent.executable like (
    "/home/*/.nvm/versions/node/*/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex", 
    "/home/*/.vscode-server/extensions/*/bin/linux-x86_64/codex", "/home/*/miniconda3/envs/py312a/bin/python3*",
    "/home/*/.local/share/uv/python/cpython-*/bin/python*"
  ) or
  process.command_line like (
    "*eNqVkl1PwjAUhu/5Fd61i2Os*",
    "/usr/bin/python*-c import zlib,base64; exec(zlib.decompress(base64.b64decode(b*",
    "*/usr/bin/python*-c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  (process.executable like "/mnt/apps/jenkins/.pyenv/versions/*/bin/python*" and process.command_line like "*eNqVkm1*") or
  (process.parent.executable like "/mnt/apps/jenkins/.pyenv/versions/*/bin/python*" and process.command_line like "*binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64*")
)
Raw source Suspicious Python Encoded Payload Execution · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies Python interpreters started with -c (inline code) where the command line suggests decoding obfuscated content
(e.g. base64, binascii, codecs) and then executing it via exec, eval, compile, or dynamic import. Also identifies child
processes spawned by a parent Python process whose command line matches the same suspicious python -c decode-and-exec
pattern, when parent telemetry is present.
"""
id = "2b5b095c-a432-4ca4-ac73-a245dbac9a95"
license = "Elastic License v2"
name = "Suspicious Python Encoded Payload Execution"
os_list = ["linux"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (
    /* Inline malicious python -c one-liner on this process */
    process.name like ("python*", "py", "pypy*") and
    process.args == "-c" and
    process.command_line like~ (
      "*base64*", "*b64decode*", "*b32decode*", "*b85decode*", "*a85decode*", "*binascii*", "*codecs.decode*", "*fromhex*",
      "*zlib.decompress*", "*marshal.loads*", "*pickle.loads*", "*cPickle.loads*"
    ) and
    process.command_line like~ (
      "*exec(*", "*eval(*", "*__import__*", "*compile(*", "*types.FunctionType*", "*runpy*", "*importlib.util*",  "*importlib.import_module*"
    )
  ) or
  /* Child of a parent Python process running the same suspicious -c pattern (parent fields populated) */
  (
    process.parent.name like ("python*", "py", "pypy*") and
    process.parent.command_line != null and
    process.parent.args == "-c" and
    process.parent.command_line like~ (
      "*base64*", "*b64decode*", "*b32decode*", "*b85decode*", "*a85decode*", "*binascii*", "*codecs.decode*", "*fromhex*",
      "*zlib.decompress*", "*marshal.loads*"
    ) and
    process.parent.command_line like~ (
      "*exec(*", "*eval(*", "*__import__*", "*compile(*", "*types.FunctionType*", "*runpy*",
      "*importlib.util*",  "*importlib.import_module*"
    )
  )
) and
not (
  process.command_line like """*exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTbCTAR1z6GFYD93JMwLXplsVtmRI9pyg6H8fKcVrmhz8IfLxkXwimRlG5yfuggonfObn0bsGAv6aF1v3KkAPzaTegrPs6eHn/tfvJ73d3TPWQscXEWTBNhiZh6l185Qv3kwgPIweXfwbz/7YTH5BdP0cXoVMBHCE5tAMbRD0Iq5RlxXbdM5zo9DGjeVg5wF8jbwraDP5E302VKz+LDp/dCNYgqmU7Yvv4XFPZvD+2sxlJMvrEcNbIYwiryQrHBsYJ76PH+MsrwOHmHshnNiquztk9QKkpAAP0+wtHxlbROahbk/Yf+OGobZtoN6Srnnd134QZ0Ulo4Z7Y4H6RQVRvaSYsTmRkEtlrbNAemL6lXEtme4n712NShIWK2HUQtAXCp9DsJyhPQz1qN8/WHfxF3SASaRakgJUTaTBjE6/Z6Y9ZoVRPCNjVtAbD0nqrCirdECBz4elNpOxL1mx+8A7jalKCjrPQqVduUZXNwCkWQHEiIBz3VcUt/YUSYQhn8eWJkdcxKgLHAm1vJoeOIKxS68O6qDT0OfpI9CjsJ2ykmkwuziVnoYA2UacMhfiLSEy75DLOiHV9n73gwbIdDyh4tCce+zaar255IwD2DiLcs3A8IA96bUvRLNN7MbD4P4C5pEJUv6XuPqutynbV3NxTRxXJmLiJRJzmOppDjrKQoFCptb0c5blb87Ejfq8qbgWuEQ33nhN5MXViDaal0qJxK9I+ii5jMtB04y78Q9tonhI")))""" or
  process.parent.command_line like """*exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTbCTAR1z6GFYD93JMwLXplsVtmRI9pyg6H8fKcVrmhz8IfLxkXwimRlG5yfuggonfObn0bsGAv6aF1v3KkAPzaTegrPs6eHn/tfvJ73d3TPWQscXEWTBNhiZh6l185Qv3kwgPIweXfwbz/7YTH5BdP0cXoVMBHCE5tAMbRD0Iq5RlxXbdM5zo9DGjeVg5wF8jbwraDP5E302VKz+LDp/dCNYgqmU7Yvv4XFPZvD+2sxlJMvrEcNbIYwiryQrHBsYJ76PH+MsrwOHmHshnNiquztk9QKkpAAP0+wtHxlbROahbk/Yf+OGobZtoN6Srnnd134QZ0Ulo4Z7Y4H6RQVRvaSYsTmRkEtlrbNAemL6lXEtme4n712NShIWK2HUQtAXCp9DsJyhPQz1qN8/WHfxF3SASaRakgJUTaTBjE6/Z6Y9ZoVRPCNjVtAbD0nqrCirdECBz4elNpOxL1mx+8A7jalKCjrPQqVduUZXNwCkWQHEiIBz3VcUt/YUSYQhn8eWJkdcxKgLHAm1vJoeOIKxS68O6qDT0OfpI9CjsJ2ykmkwuziVnoYA2UacMhfiLSEy75DLOiHV9n73gwbIdDyh4tCce+zaar255IwD2DiLcs3A8IA96bUvRLNN7MbD4P4C5pEJUv6XuPqutynbV3NxTRxXJmLiJRJzmOppDjrKQoFCptb0c5blb87Ejfq8qbgWuEQ33nhN5MXViDaal0qJxK9I+ii5jMtB04y78Q9tonhI")))""" or
  process.parent.executable in (
    "/usr/sbin/sshd", "/usr/bin/sudo", "/usr/lib/openssh/sshd-session", "/opt/teleport/system/bin/teleport",
    "/usr/libexec/openssh/sshd-session", "/usr/bin/ansible-playbook", "/usr/bin/sort", "/usr/bin/du",
    "/usr/sbin/ldconfig.real", "/usr/sbin/runuser"
  ) or
  process.working_directory like ("/opt/zeek", "/var/lib/docker/overlay2/*/usr/local/zeek", "/usr/share/ansible") or
  process.parent.args == "/usr/local/bin/ansible-playbook" or
  process.parent.command_line like (
    "*IyBweWxpbnQ6IGRpc2FibGU9cmVzb3VyY2UtbGVha2FnZQoiIiIKVGhpcyBpcyBhIHNoaW0gdGhh*",
    "/usr/bin/python*-c import zlib,base64; exec(zlib.decompress(base64.b64decode(b*",
    "*/usr/bin/python*-c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  process.executable like (
   "/home/*/.local/share/uv/python/cpython-*/bin/python*", "/home/*/miniconda3/envs/py312a/bin/python3*"
  ) or
  process.parent.executable like (
    "/home/*/.nvm/versions/node/*/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex", 
    "/home/*/.vscode-server/extensions/*/bin/linux-x86_64/codex", "/home/*/miniconda3/envs/py312a/bin/python3*",
    "/home/*/.local/share/uv/python/cpython-*/bin/python*"
  ) or
  process.command_line like (
    "*eNqVkl1PwjAUhu/5Fd61i2Os*",
    "/usr/bin/python*-c import zlib,base64; exec(zlib.decompress(base64.b64decode(b*",
    "*/usr/bin/python*-c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  (process.executable like "/mnt/apps/jenkins/.pyenv/versions/*/bin/python*" and process.command_line like "*eNqVkm1*") or
  (process.parent.executable like "/mnt/apps/jenkins/.pyenv/versions/*/bin/python*" and process.command_line like "*binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.