HEAVYGRAM os.popen() Shell Execution and cmd.Dat Output Staging

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•3

Detects instances where suspicious or potentially non-standard processes (e.g., winappx.exe, MsCache.exe) or Python scripts running from specific ProgramData subdirectories spawn cmd.exe with a /c command line argument. This pattern is often indicative of persistence mechanisms, lateral movement, or malicious script execution.