Evasive Panda Secondary Loader Writes status.dat or perf.dat in eHome Directory

Daniel Jeremiah@daniyyell

•updated Feb 5, 2026•0•24

This rule detects the creation or modification of 'status.dat' or 'perf.dat' files within the 'C:\ProgramData\Microsoft\eHome' directory. The detection is specifically triggered when the process performing this file operation is either 'evteng.exe' or another process located within the 'eHome' directory, or 'libpython2.4.dll'. This activity is associated with the Evasive Panda secondary loader.