Python Image Load By Non-Python Process
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the image load of "Python Core" by a non-Python process. This might be indicative of a Python script bundled with Py2Exe.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_imageloaded" AND MESSAGE contains "Python Core" AND (PROCESSNAME notcontains "Python" AND PROCESSNAME notstartswith "C:\Program Files\,C:\Program Files (x86)\,C:\ProgramData\Anaconda3") AND isExist(PROCESSNAME) select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Patrick St. John, OTR (Open Threat Research)
