Suspicious Linux Python RAT Execution

Detects the execution of the specific Linux payload path '/tmp/ld.py', commonly executed via python3 in the background by the dropper associated with the Axios npm supply chain attack.