Suspicious Python One-Liner with Encoded Payload Execution

[rule]
description = """
Identifies Python interpreters started with -c (inline code) where the command line suggests decoding obfuscated content
(e.g. base64, binascii, codecs) and then executing it via exec, eval, compile, or dynamic import. Also identifies child
processes spawned by a parent Python process whose command line matches the same suspicious python -c decode-and-exec
pattern, when parent telemetry is present.
"""
id = "a4c9e1b2-8d3f-4a5e-9c7b-2f6e8d0a1b3c"
license = "Elastic License v2"
name = "Suspicious Python One-Liner with Encoded Payload Execution"
os_list = ["macos", "windows"]
reference = ["https://attack.mitre.org/techniques/T1059/006/", "https://attack.mitre.org/techniques/T1027/"]
version = "1.0.2"

query = '''
process where event.type == "start" and event.action in ("start", "exec")  and
  (
   /* Inline malicious python -c one-liner on this process */
   (
    process.name : ("python*", "py.exe", "py", "pypy*") and
    process.args : "-c" and
    process.command_line : (
      "*b64decode*",
      "*b32decode*",
      "*b85decode*",
      "*a85decode*",
      "*.read().decode(*",
      "*binascii*",
      "*codecs.decode*",
      "*fromhex*",
      "*zlib.decompress*",
      "*marshal.loads*"
    ) and
    process.command_line : (
      "*exec(*",
      "*eval(*",
      "*__import__*",
      "*compile(*",
      "*types.FunctionType*",
      "*runpy*",
      "*importlib.util*",
      "*importlib.import_module*"
    )
   )
   or
   /* Child of a parent Python process running the same suspicious -c pattern (parent fields populated) */
   (
    process.parent.name : ("python*", "py.exe", "py", "pypy*") and
    process.parent.command_line != null and
    process.parent.args : "-c" and
    process.parent.command_line : (
      "*b64decode*",
      "*b32decode*",
      "*b85decode*",
      "*a85decode*",
      "*.read().decode(*",
      "*binascii*",
      "*codecs.decode*",
      "*fromhex*",
      "*zlib.decompress*",
      "*marshal.loads*"
    ) and
    process.parent.command_line : (
      "*exec(*",
      "*eval(*",
      "*__import__*",
      "*compile(*",
      "*types.FunctionType*",
      "*runpy*",
      "*importlib.util*",
      "*importlib.import_module*"
    )
    and not process.executable : "?:\\Windows\\System32\\conhost.exe"
   )
  ) and
  not process.parent.executable like~ (
    "*/opencode-ai/*/opencode*",
    "*/opencode-darwin-arm64/bin/opencode",
    "*/opencode-linux-*/bin/opencode"
  ) and
  not process.parent.executable like~ "/Applications/Alfred*.app/*" and
  not (process.command_line : (
         "*runpy.run_module(\"pip\"*",
         "*runpy.run_module('pip'*",
         "*ensurepip*"
       ) and
       process.executable like~ (
         "*/Python.framework/Versions/*/bin/python*",
         "*/Python.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python",
         "*/Python3.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python",
         "/opt/homebrew/Cellar/python*/*/bin/python*",
         "/usr/local/Cellar/python*/*/bin/python*",
         "/usr/bin/python*"
       )) and
  not (process.parent.command_line : (
         "*runpy.run_module(\"pip\"*",
         "*runpy.run_module('pip'*",
         "*ensurepip*"
       ) and
       process.parent.executable like~ (
         "*/Python.framework/Versions/*/bin/python*",
         "*/Python.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python",
         "*/Python3.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python",
         "/opt/homebrew/Cellar/python*/*/bin/python*",
         "/usr/local/Cellar/python*/*/bin/python*",
         "/usr/bin/python*"
       )) and
  not process.Ext.effective_parent.executable like~ (
         "/Applications/Cursor.app/*",
         "/Users/*/Applications/Cursor.app/*",
         "/Applications/Codex.app/*",
         "/Users/*/Applications/Codex.app/*",
         "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/*", 
         "/Applications/Visual Studio Code.app/Contents/MacOS/Code"
       ) and 
  not process.parent.command_line like "*/Users/*/shell-snapshots/snapshot-*"
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.5.0"