Windowless Python Execution From Suspicious User-Writable Path
Detects pythonw.exe executing .pyw scripts from user-writable directories outside canonical Python installation paths. This execution pattern is used by Operation HumanitarianBait (module.pyw from %APPDATA%\WindowsHelper) and similar PyArmor-packed Python infostealer campaigns like PXA Stealer and JarkaStealer. These campaigns drop self-contained Python environments into vendor-mimicking AppData subdirectories. The rule catches the specific HumanitarianBait path/script combination and variants that alter the path or script name while maintaining the windowless-Python-from-AppData primitive.
Cortex XDR
