SNOWBASIN Python bindshell: local port 8000/8001/8002 listener spawning cmd/powershell shortly after

Duo Tech@duotech

•updated Aug 5, 2026•6•0•8

Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.