TA4922 SilentRunLoader: Python Spawned by Non-IDE Parent from Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of Python interpreters from non-standard or typically user-writable locations (e.g., AppData, Temp, Downloads) or when the command line includes execution of a script file. This rule excludes common development environments to reduce noise, focusing on potentially malicious usage of Python for persistence or execution of staged scripts.