Shell Spawned by Celery Worker Process

calendar Oct 17, 2026 · attack.execution attack.t1059.004  ·
Share on: linkedin copy

Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

Sigma rule (View on GitHub)

 1title: Shell Spawned by Celery Worker Process
 2id: 904f6442-3b57-4b3f-987c-1559f58ce8d8
 3status: experimental
 4description: |
 5    Detects a system shell interpreter being spawned directly by a Celery worker process.
 6    This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
 7    which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.    
 8references:
 9    - https://docs.celeryq.dev/en/stable/userguide/tasks.html
10    - https://genai.owasp.org/llmrisk/llm01-prompt-injection/
11    - https://labs.cloudsecurityalliance.org/research/csa-research-note-promptware-c2-agent-exploitation-20260406/
12    - https://nvd.nist.gov/vuln/detail/CVE-2021-23727
13    - https://owasp.org/www-project-top-10-for-large-language-model-applications/
14    - https://security.snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
15    - https://snyk.io/blog/python-rce-vulnerability/
16    - https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
17    - https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks
18author: Jennifer Batina
19date: 2026-10-17
20tags:
21    - attack.execution
22    - attack.t1059.004
23logsource:
24    category: process_creation
25    product: linux
26detection:
27    selection_img:
28        Image|endswith:
29            - '/ash'
30            - '/bash'
31            - '/busybox'
32            - '/csh'
33            - '/dash'
34            - '/fish'
35            - '/ksh'
36            - '/sh'
37            - '/tcsh'
38            - '/zsh'
39        ParentCommandLine|contains: 'celery'
40    selection_parent:
41        - ParentImage|endswith:
42              - '/python'
43              - '/python3'
44        - ParentImage|contains: '/python3.'
45    condition: all of selection_*
46falsepositives:
47    - Legacy or custom administrative tasks deliberately hardcoded with shell=True or os.system execution inside Celery task functions.
48    - Media processing, deployment, or reporting pipelines that intentionally shell out to external tools (e.g. ffmpeg, git) from within a task.
49level: medium

References

Related rules

to-top