Python SOCKS5 proxy (socks5.py) execution for persistent access

Ankit Mehta@Secvyn

•updated 28 days ago•1•0•2

Detects the execution of Python scripts explicitly named 'socks5.py'. This is a common pattern used by adversaries to establish proxying capabilities for command and control or to tunnel traffic through a compromised host.