Rule Info
Name
Inline Python Execution - Spawn Shell Via OS System Library
Author
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Description
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Date
2024-09-02 00:00:00
Modified
None
Id
2d2f44ff-4611-4778-a8fc-323a0e9850cc
Tags
attack.execution attack.t1059 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR