Suspicious python3 Script Execution from /tmp Spawned by zsh with Network Indicators

Duo Tech@duotech

•updated Aug 10, 2026•0•0•1

Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.