CVE-2026-24294 Python Impacket SMB Relay - Outbound to Loopback/Internal

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects when the Python interpreter (python.exe or py.exe) initiates a network connection to an internal or loopback IP address. This behavior can be indicative of a local process scanning the internal network, pivoting, or interacting with locally running services as part of a post-exploitation or reconnaissance activity.