Glassworm - Python Obfuscated Execution String (T1027)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•2

Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.