Rudolf Lukac
@rudyzCompletionist
0 followers0 downloads7 copies0 likes70 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
