CmdID

CmdID / Commands

py

Python Launcher for Windows that runs with specified Python version. tldr-pages

On Windows 1 Sigma rule name it File py.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Start a REPL (interactive shell), optionally with arguments supported by python (like -c, -m, etc.)

py python_argumentsIdentify

Execute a specific Python file

py path\to\file.pyIdentify

Run specific Python version. If the version is missing, and PYLAUNCHER_ALLOW_INSTALL environment variable is set, auto-install via Microsoft Store or Winget

List installed Python versions

py --listIdentify

What detects it

Sigma process creation rules that name py
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

See also

python