Suspicious Renamed Python Execution
Detects the execution of a renamed Python executable (csshost.exe) running Python scripts. This behavior is a known defense evasion technique associated with the PyLangGhost RAT, which is deployed by the NICKEL ALLEY threat group in their Contagious Interview campaigns.
Sigma
