PXA Stealer - Suspicious Python Execution Masquerading as svchost.exe
This rule detects suspicious Python script execution masquerading as 'svchost.exe'. Specifically, it looks for 'svchost.exe' processes running from a user's profile directory that execute Python code containing 'import', 'requests', 'exec(', and references to 'http://' or 'https://' in the command line. This pattern is indicative of a Python-based malware or script attempting to download and execute additional code, potentially for command and control or further compromise, while trying to blend in with legitimate system processes.
Microsoft Sentinel (KQL)
