Shell Spawned by Celery Worker Process

Jennifer Batina

Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

2026-10-17 00:00:00

None

904f6442-3b57-4b3f-987c-1559f58ce8d8

attack.execution attack.t1059.004

Community Rule

JENNIFER BATINA

Merge PR #6120 from @Batina-Jennifer - Add Celery worker shell-spawn detection

2026-10-17