Python -c execution decoding Base64 payload (JadePuffer Langflow RCE)

Duo Tech@duotech

•updated Jul 8, 2026•4•0•3

Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.