CmdID

CmdID / Files

python3.exe

Program on Windows 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real python3.exe?

file version info and known copies
Installed inC:\Users\user\AppData\Local\Microsoft\WindowsApps\
Signed byMicrosoft Corporation

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma process creation rules that name python3.exe
mediumPython Inline Command ExecutionNasreddine Bencherchali (Nextron Systems)