Xoscar actor pool spawning shell after inbound connection (cloudpickle RCE)
Detects potential remote code execution against Xinference or Xoscar pool processes, identified by an inbound network connection accepted by a Python-based worker followed shortly by the spawning of a shell process (sh, bash, dash) by the same process.
Microsoft Sentinel (KQL)
