Python Path Configuration File Creation - Windows
Detects the creation of Python path configuration files (.pth) within Python library folders on Windows systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically targets files ending with '.pth' in paths matching '\(venv|python(.+)?)\lib\site-packages\', while filtering out known legitimate .pth files like 'pywin32.pth' and 'distutils-precedence.pth'.
Sigma
