Inline Python Execution - Spawn Shell Via OS System Library
This rule detects the execution of inline Python code that uses the `os.system()` function to spawn a shell. Specifically, it looks for Python interpreter executables being run with the `-c` argument (for inline code execution) and the command line containing both `os.system(` and common shell paths like `/bin/bash`, `/bin/sh`, etc. This technique is often used by adversaries to gain interactive shell access or execute arbitrary commands on a compromised system.
Sigma
