Stager Python interpreter discovery via cmd.exe from AutoHotkey parent chain

Duo Tech@duotech

•updated Aug 5, 2026•1•0•0

Detects cmd.exe invoking a Python version-check command (python --version or python3 --version) spawned from an AutoHotkey process or .ahk script. This behavior is consistent with the UNC6692 Edgecution stager, which verifies the presence of a bundled Python interpreter before deploying malicious browser extension payloads.