Python Image Load By Non-Python Process

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•2•0•37

This rule detects when a non-Python process loads the "Python Core" image. This behavior is often indicative of an executable that has been bundled from Python code using tools like Py2Exe, PyInstaller, or cx_Freeze. Threat actors commonly use these tools to package malicious Python scripts into standalone executables, which can help obfuscate their code or bypass security measures. The rule filters out legitimate Python processes and common installation paths to reduce false positives.