Suspicious Python Command-Line Execution with Network Activity

Awais Munir@iawais

•updated Feb 16, 2026•3•0•64

This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.