All Detections

Python DeviceManager RAT (run.pyw) spawning encoded PowerShell/cmd C2 tasking

avatar
Duo Tech@duotech
updated Aug 13, 2026003

Detects the DeviceManager RAT (run.pyw, spawned via python.exe/pythonw.exe) launching PowerShell or cmd with encoded/obfuscated arguments (-enc, -EncodedCommand, -e, -nop, -w hidden), consistent with C2-tasked arbitrary command execution.

Microsoft Sentinel (KQL)