Python Process Spawning Interactive Shell - Reverse Shell Indicator

Ankit Mehta@Secvyn

•updated Jun 30, 2026•4•0•5

Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.