Portable Python Interpreter Execution from Public Directory
Detects the execution of python.exe from the C:\Users\Public\ directory. Adversaries frequently use this technique by dropping a portable Python environment into a globally writable location to execute malicious scripts without requiring an official Python installation, often as part of information stealing malware payloads.
Microsoft Sentinel (KQL)
