Python Inline Command Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•11•0•29

Detects execution of python using the "-c" flag. This could be used as a way to launch a reverse shell or execute live python code. The rule filters out common legitimate uses of `python -c` by Python itself, pip, and VS Code.