Python Spawning Pretty TTY Via PTY Module — Detection Rule

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

Read the full analysis on IntelFusions