Zammad host spawning a burst of new .sh/.py script files after compromise
Detects a burst of newly created Python or Shell scripts on a host running the Zammad ticketing system, which can indicate post-exploitation activity or automated staging.
Microsoft Sentinel (KQL)
