kqlElastic-2.0from elastic/detection-rules
First Time Python Spawned a Shell on Host
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/macos/execution_python_shell_spawn_first_occurrence.toml
event.category:process and host.os.type:macos and event.type:start and event.action:exec and
process.parent.name:python* and
process.name:(bash or dash or sh or tcsh or csh or zsh or ksh or fish) and process.args:"-c" and
not process.command_line:(*pip* or *conda* or *brew* or *jupyter*)