Shell Spawned by Celery Worker Process
Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
Image|endswith:
- '/ash'
- '/bash'
- '/busybox'
- '/csh'
- '/dash'
- '/fish'
- '/ksh'
- '/sh'
- '/tcsh'
- '/zsh'
ParentCommandLine|contains: 'celery'
selection_parent:
- ParentImage|endswith:
- '/python'
- '/python3'
- ParentImage|contains: '/python3.'
condition: all of selection_*Legacy or custom administrative tasks deliberately hardcoded with shell=True or os.system execution inside Celery task functions.
Media processing, deployment, or reporting pipelines that intentionally shell out to external tools (e.g. ffmpeg, git) from within a task.
Tactics
Sub-techniques