All Detections

MuddyWater gp_v6_exec.py Execution

avatar
Ibrahim Saud@tektrix
updated Jun 17, 2026009

Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.

Microsoft Sentinel (KQL)