Clunk1068 Python Sideloading Of Python20dll
This rule detects a Python process loading a DLL named 'python20.dll'. This specific combination was observed in the CL-UNK-1068 activity, where attackers used this technique for purposes such as launching scanning tools, maintaining covert tunnels, or executing other malicious programs while attempting to blend in with legitimate software. The rule focuses on this specific pattern to identify strong leads related to the campaign, rather than generating broad alerts for all Python activities or DLL loads.
YARA-L
