Recon Commands (id, uname -a, hostname, ifconfig, ps) Spawned by Python Child Process

Duo Tech@duotech

•updated Jul 8, 2026•2•0•13

Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.