{"id":"d36f7c12-14a3-4d48-b6b8-774b9c66f44d","title":"Potential Python DLL SideLoading","description":"Detects potential DLL sideloading of Python DLL files.","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-10-06","modified":"2025-08-18","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Legitimate software using Python DLLs"],"references":["https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/","https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/","https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python"],"source_path":"rules/windows/image_load/image_load_side_load_python.yml","source_sha256":"713105a093ce4d3d97478e0a40ee35dd3915e7ab417f0fe527b90e314488c885","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_python.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Python DLL SideLoading\nid: d36f7c12-14a3-4d48-b6b8-774b9c66f44d\nstatus: test\ndescription: Detects potential DLL sideloading of Python DLL files.\nreferences:\n    - https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/\n    - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/\n    - https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-10-06\nmodified: 2025-08-18\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\python39.dll'\n            - '\\python310.dll'\n            - '\\python311.dll'\n            - '\\python312.dll'\n    filter_main_default_install_paths:\n        - ImageLoaded|startswith:\n              - 'C:\\Program Files\\Python3'\n              - 'C:\\Program Files (x86)\\Python3'\n        - ImageLoaded|contains: '\\AppData\\Local\\Programs\\Python\\Python3'\n    filter_optional_visual_studio:\n        ImageLoaded|startswith: 'C:\\Program Files\\Microsoft Visual Studio\\'\n    filter_optional_anaconda:\n        ImageLoaded|startswith: 'C:\\ProgramData\\Anaconda3\\' # Comment out if you don't use Anaconda in your environment\n    filter_optional_cpython:\n        ImageLoaded|contains:\n            - '\\cpython\\externals\\'\n            - '\\cpython\\PCbuild\\'\n    filter_optional_pyinstaller:\n        # Triggered by programs bundled with PyInstaller\n        ImageLoaded|startswith: 'C:\\Users'\n        ImageLoaded|contains: '\\AppData\\Local\\Temp\\_MEI'\n    filter_main_legit_signature_details:\n        Product: 'Python'\n        Signed: 'true'\n        Description: 'Python'\n        Company: 'Python Software Foundation'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software using Python DLLs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/d36f7c12-14a3-4d48-b6b8-774b9c66f44d.json","kind":"sigma"}