← Library
kqlElastic-2.0from elastic/detection-rules

First Time Python Spawned a Shell on Host

Quality
92
FP risk
Forks
0
Views
0
ATT&CK techniques
Rule sourcerules/macos/execution_python_shell_spawn_first_occurrence.toml
event.category:process and host.os.type:macos and event.type:start and event.action:exec and
process.parent.name:python* and
process.name:(bash or dash or sh or tcsh or csh or zsh or ksh or fish) and process.args:"-c" and
not process.command_line:(*pip* or *conda* or *brew* or *jupyter*)