CastleLoader - ProgramData Pyc Execution

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects pythonw.exe running compiled Python bytecode (.pyc) specifically from attacker-generated staging directories in ProgramData. The rule looks for specific directory names (Ccrreewwll, NewKevinNotAnother, NewestWorkiNaprav) followed by an alphanumeric string and a .pyc extension within the ProgramData directory.