CastleLoader - PowerShell executes suspicious Python script located in an AppData\Roaming directory

Thomas Carr@Tomcat

•updated Jul 29, 2026•7•0•15

This rule detects suspicious process execution where PowerShell (powershell.exe) spawns a Python interpreter (python.exe or pythonw.exe) located in an AppData\Roaming directory. It specifically flags instances where the command line of the invoked process includes both a reference to the AppData\Roaming directory and a Python script (.py) file, which is a common behavior for loaders like CastleLoader attempting to execute scripts from user-writable directories.