Outbound Network Connection from Python After Module Init

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.