Xoscar actor pool host inbound connection followed by reverse shell outbound
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Microsoft Sentinel (KQL)
