Python Image Load By Non-Python Process — Sigma Rule

Rule metadata and linked tags

Author: Patrick St. John, OTR (Open Threat Research). Source status: test; severity: low. Source dates: 2020-05-03 / 2025-08-18.

{
  "product": "windows",
  "category": "image_load"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 66ba5f3a70a49d8f83914673b5764a65615cc5532e3dbf00450f873d3ba0e666

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Python Image Load By Non-Python Process
id: cbb56d62-4060-40f7-9466-d8aaf3123f83
status: test
description: |
    Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.
    Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.
    Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.
references:
    - https://www.py2exe.org/
    - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/
author: Patrick St. John, OTR (Open Threat Research)
date: 2020-05-03
modified: 2025-08-18
tags:
    - attack.stealth
    - attack.t1027.002
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Description: 'Python Core'
    filter_main_generic:
        - Image|contains: 'Python'  # FPs with python38.dll, python.exe etc.
        - Image|startswith:
              - 'C:\Program Files\'
              - 'C:\Program Files (x86)\'
              - 'C:\ProgramData\Anaconda3\' # Comment out if you don't use Anaconda in your environment
    filter_optional_null_image:
        Image: null
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate Py2Exe Binaries
    - Known false positive caused with Python Anaconda
    - Various legitimate software is bundled from Python code into executables
level: low

Original YAML and metadata in JSON

False positives

• Legitimate Py2Exe Binaries
• Known false positive caused with Python Anaconda
• Various legitimate software is bundled from Python code into executables

Source references

• https://www.py2exe.org/
• https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/