TeamPCP - Elementary .pth File Python Startup Execution
Identifies the execution of the elementary.pth payload natively triggering on Python interpreter startup. This rule correlates process events for Python execution with file events indicating the presence of an 'elementary.pth' file on the same device.
Microsoft Sentinel (KQL)
