SilentRunLoader Python Execution from Temp/AppData or Spawning Shell Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious Python script execution by monitoring for 'python.exe' or 'pythonw.exe' processes running from suspicious locations such as 'AppData' or 'Temp' directories. It also flags 'python.exe' when it initiates suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe) and alerts on 'pythonw.exe' execution when not initiated by trusted installers.