Python Reverse Shell Execution Via PTY And Socket Modules

SigmaHQ Detections@sigmaHQ

•updated Nov 4, 2024•1•0•22

Detects the execution of Python code that imports the 'pty' and 'socket' modules and uses 'spawn' and '.connect' functions, which is a common pattern for establishing a reverse shell.