Windows Process Outbound Connection To Social Media Domain — Detection Rule
This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.