Python Process Command Line Referencing Base64 Decode, Zlib Decompression, and Ctypes Dynamic API Resolution
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Microsoft Sentinel (KQL)
