MEDIUM Suspicious Process Creation
Prevented (Blocked)
ID: #1911
|
Detected: 2026-01-02 11:54:05
|
Malware
Alert Overview
Suspicious process creation detected
Unclassified
XDR Agent
New
DS:PANW/XDR Agent
DOM:Security
Host Information
Process Information
Process Execution
Actor Process (Executor)
| Process Name | python.exe |
|---|---|
| Path | C:\Users\dokji\scoop\apps\python\3.14.2\python.exe |
| PID | 17324 |
| SHA256 |
fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a
VT
|
| MD5 | 9bd26657353d7441a72f29ab43f1fd37 |
| Signature | Python Software Foundation N/A |
"python" incident_generator.py --category credential Action Process (Target)
| Process Name | cmd.exe |
|---|---|
| SHA256 |
64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4
VT
|
| Signature | Microsoft Windows Signed |
C:\WINDOWS\system32\cmd.exe /c "powershell -c "sekurlsa::logonpasswords""Severity Analysis
MEDIUM
Review and assess impact
Summary
Events
1
IP Addresses
1
Tags
2
File Artifacts
Yes
Network Artifacts
No
Registry Artifacts
No
Analyst Verdict