Unusual Python Execution Location
Detects the execution of a Python interpreter (python.exe or pythonw.exe), potentially renamed, from a non-standard, user-writable location. This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
Sigma
