AI Brands as Bait - Pythonw connecting via HTTP POST
Correlates pythonw.exe network connections with HTTP POST characteristics (if Deep Packet Inspection data available) for data exfil. This rule specifically looks for network connections initiated by 'pythonw.exe' to known malicious domains ('brokeapt.com', 'pan.ssffaa19.xyz').
Microsoft Sentinel (KQL)
