Python Process Making Multiple Public Network Connections

Ankit Mehta@Secvyn

•updated Jun 5, 2026•1•0•5

Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.