Shell Spawned by Celery Worker Process

Title: Shell Spawned by Celery Worker Process
Status: experimental
Description:Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
References:
  -https://docs.celeryq.dev/en/stable/userguide/tasks.html
  -https://genai.owasp.org/llmrisk/llm01-prompt-injection/
  -https://labs.cloudsecurityalliance.org/research/csa-research-note-promptware-c2-agent-exploitation-20260406/
  -https://nvd.nist.gov/vuln/detail/CVE-2021-23727
  -https://owasp.org/www-project-top-10-for-large-language-model-applications/
  -https://security.snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
  -https://snyk.io/blog/python-rce-vulnerability/
  -https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
  -https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks
Author: Jennifer Batina
Date: 2026-10-17
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.004'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection_img:
    Image|endswith:
      -'/ash'
      -'/bash'
      -'/busybox'
      -'/csh'
      -'/dash'
      -'/fish'
      -'/ksh'
      -'/sh'
      -'/tcsh'
      -'/zsh'

    ParentCommandLine|contains: 'celery'
  selection_parent:
    - ParentImage|endswith:
      - '/python'
      - '/python3'
ParentImage|contains:'/python3.'   condition:all of selection_*
Falsepositives:
  -Legacy or custom administrative tasks deliberately hardcoded with shell=True or os.system execution inside Celery task functions.
  -Media processing, deployment, or reporting pipelines that intentionally shell out to external tools (e.g. ffmpeg, git) from within a task.
Level: medium