T1005: HDF5 External-Storage Dataset Triggers Arbitrary File Read (envu8/mainu8/startu8)

Tim Peck@timpeck

•updated Jul 29, 2026•13•0•37

Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.