Internal port scan (135/445/3389) via portable Python executable - rapid burst
Detects anomalous network behavior where a python.exe process initiates connections to multiple internal hosts across sensitive ports (135/445/3389) in a short time frame. This pattern is indicative of reconnaissance or lateral movement staging, commonly observed with portable Python interpreters used by malware suites like Edgecution.
Microsoft Sentinel (KQL)
