Python Spawning Pseudo-Terminal (TTY) on Windows
Detects the execution of Python with command-line arguments that indicate an attempt to spawn a pseudo-terminal (TTY). This technique is often used by attackers to gain an interactive shell, especially in compromised environments where direct shell access might be restricted. The rule specifically looks for Python executable names combined with command-line patterns like 'import pty', '.spawn(', or 'from pty import spawn'.
Sigma
