Cisco-Nvm

Anomalous execution pattern where Unix-based browser processes spawn shells to initiate outbound external network connections, a TTP indicative of potential drive-by exploitation or browser-based post-exploitation.

A detection identifies suspicious installations of Python packages, leveraging Cisco NVM flow telemetry to monitor `pip` or `poetry` commands making outbound connections to public repositories for package names resembling known typosquats, indicating potential malicious software supply chain compromise.

Detection of suspicious downloads from file sharing and content delivery platforms using living-off-the-land binaries (LOLBins) to identify potential initial access, payload staging, or command and control activity.

Attackers are leveraging Chromium-based browsers in headless mode with the `--dump-dom` argument to download files from file-sharing services and direct IPs, potentially indicative of reconnaissance or malware delivery.