Python Path Configuration File Creation - macOS
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Sigma
