GhostSocks - Hidden Virtual Environment Setup (T1564)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

Detects the creation of hidden Python virtual environments (.venv, .pip) in user directories used to cleanly execute OpenClaw and GhostSocks without system dependencies. This rule specifically looks for 'python.exe' executing with the '-m venv' argument followed by a hidden directory name (starting with a dot) and joins this with file events indicating a folder creation.