SNOWBASIN - Local Loopback HTTP Server Backend (T1090.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects python binding shell instances attempting to listen on ports 8000, 8001, or 8002 to act as a local proxy node.