UNC6692 SNOWBASIN Shell Execution via Python Bindshell
Detects Python executables spawning shell interpreters such as cmd.exe or powershell.exe. This activity is indicative of the SNOWBASIN local HTTP bindshell proxying and executing remote commands on the host system on behalf of the attacker, as observed in UNC6692 campaigns.
Sigma
