TeamPCP - Malicious PyPI Package Subprocess Execution

Georg Lauenstein@gsec

•updated 11 days ago•0•0•0

Detects cmd.exe spawned by a python.exe or pip.exe process with a command line invoking netstat or calc.exe. Matches the payload behavior described for the malicious redpy_demo PyPI package, whose __main__.py used Python's subprocess module to execute these commands via cmd.exe automatically at module invocation, without any direct victim interaction with the payload.