AI Supply Chain - Reverse Shell from AI Process (T1059.004)
Detects a reverse shell executed by the Python interpreter during what should be an isolated AI model loading process. This rule specifically looks for common reverse shell patterns (nc -e, bash -i, sh -i, /dev/tcp/) in the command line of processes initiated by 'python.exe'.
Microsoft Sentinel (KQL)
