UNC6692 Internal Reconnaissance via Python
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
Sigma
