LoFP LoFP / python libraries that use a flag starting with \"-c\". filter according to your environment

Techniques

Sample rules

Python Inline Command Execution

Description

Detects execution of python using the “-c” flag. This is could be used as a way to launch a reverse shell or execute live python code.

Detection logic

condition: all of selection_* and not 1 of filter_*
filter_python:
  ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip
  ParentImage|endswith: \python.exe
  ParentImage|startswith: C:\Program Files\Python
filter_vscode:
  ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
selection_cli:
  CommandLine|contains: ' -c'
selection_img:
- OriginalFileName: python.exe
- Image|endswith:
  - python.exe
  - python3.exe
  - python2.exe