Pythonw.exe Dropped in AppData without Digital Signature
This rule detects the creation of 'pythonw.exe' within a user's AppData\Local folder. This is a suspicious activity, especially when the file lacks a valid digital signature, as it could indicate the dropping of malicious Python interpreters or scripts by threat actors. The rule specifically looks for the file name and folder path, with an implicit check for the absence of a digital signature (which would require a 'FileProfile' join in a production environment).
Microsoft Sentinel (KQL)
