• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    PySoxy Staging Download

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 17, 2026•0•0•1

    Detects Python or curl downloading payloads from the PySoxy staging IP 206.206.103.106. This indicates potential ingress tool transfer or staging activity by an adversary.

    Microsoft Sentinel (KQL)

    Tags

    T1105 - Ingress Tool TransferT1059.006 - PythonTA0011 - Command and ControlTA0002 - ExecutionNetwork Connection OutboundFile DownloadWindowskql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?