Python process exfiltrating to litellm.dev/healthcheck (privcollect stealer)
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Microsoft Sentinel (KQL)
