{"id":"cbb56d62-4060-40f7-9466-d8aaf3123f83","title":"Python Image Load By Non-Python Process","description":"Detects the image load of \"Python Core\" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.\nVarious tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.\nThreat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.\n","author":"Patrick St. John, OTR (Open Threat Research)","status":"test","level":"low","date":"2020-05-03","modified":"2025-08-18","tags":["attack.stealth","attack.t1027.002"],"technique_ids":["T1027.002"],"logsource":{"product":"windows","category":"image_load"},"falsepositives":["Legitimate Py2Exe Binaries","Known false positive caused with Python Anaconda","Various legitimate software is bundled from Python code into executables"],"references":["https://www.py2exe.org/","https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/"],"source_path":"rules/windows/image_load/image_load_susp_python_image_load.yml","source_sha256":"66ba5f3a70a49d8f83914673b5764a65615cc5532e3dbf00450f873d3ba0e666","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_python_image_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Python Image Load By Non-Python Process\nid: cbb56d62-4060-40f7-9466-d8aaf3123f83\nstatus: test\ndescription: |\n    Detects the image load of \"Python Core\" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.\n    Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.\n    Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.\nreferences:\n    - https://www.py2exe.org/\n    - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/\nauthor: Patrick St. John, OTR (Open Threat Research)\ndate: 2020-05-03\nmodified: 2025-08-18\ntags:\n    - attack.stealth\n    - attack.t1027.002\nlogsource:\n    product: windows\n    category: image_load\ndetection:\n    selection:\n        Description: 'Python Core'\n    filter_main_generic:\n        - Image|contains: 'Python'  # FPs with python38.dll, python.exe etc.\n        - Image|startswith:\n              - 'C:\\Program Files\\'\n              - 'C:\\Program Files (x86)\\'\n              - 'C:\\ProgramData\\Anaconda3\\' # Comment out if you don't use Anaconda in your environment\n    filter_optional_null_image:\n        Image: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate Py2Exe Binaries\n    - Known false positive caused with Python Anaconda\n    - Various legitimate software is bundled from Python code into executables\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.002","id":"T1027.002","name":"Software Packing","page":"techniques/enterprise/T1027.002/"}],"data_path":"data/detection-rules/cbb56d62-4060-40f7-9466-d8aaf3123f83.json","kind":"sigma"}