Potential Python DLL SideLoading
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects potential DLL sideloading of Python DLL files.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_imageloaded" AND OBJECTNAME endswith "\python39.dll,\python310.dll,\python311.dll,\python312.dll" AND ((OBJECTNAME notstartswith "C:\Program Files\Python3,C:\Program Files (x86)\Python3" AND OBJECTNAME notcontains "\AppData\Local\Programs\Python\Python3") AND (PRODUCT_NAME != "Python" OR SIGNED != "true" OR MESSAGE != "Python" OR COMPANY_NAME != "Python Software Foundation")) AND (OBJECTNAME notstartswith "C:\Program Files\Microsoft Visual Studio" AND OBJECTNAME notcontains "\cpython\externals\,\cpython\PCbuild") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Swachchhanda Shrawan Poudel
