Python WebServer Execution - Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 28, 2025•2•0•24

This rule detects the execution of Python web servers via the command line interface (CLI) on Linux systems. Adversaries often use Python's built-in HTTP server modules (like `http.server` or `SimpleHTTPServer`) in post-exploitation scenarios to quickly establish a web server without needing to install additional software. This allows them to easily transfer files between a compromised host and attacker-controlled systems, facilitating data exfiltration or further payload delivery.