Possible Python Image Load By Non-Python Process (via image_load)

title: Possible Python Image Load By Non-Python Process (via image_load)
id: 4383b49e-0b4f-54a2-a5ef-0a5b415e9829
status: stable
description: This rule detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are leveraged to bundle Python code into standalone executables. Threat actors frequently use these tools to bundle hostile Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.
references:
    - https://attack.mitre.org/techniques/T1027/002/
    - https://www.py2exe.org/
    - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/
author: Huntrule Team
date: 2026-03-06
tags:
    - attack.stealth
    - attack.t1027.002
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Description: 'Python Core'
    filter_main_generic:
        - Image|contains: 'Python'
        - Image|startswith:
              - 'C:\Program Files\'
              - 'C:\Program Files (x86)\'
              - 'C:\ProgramData\Anaconda3\'
    filter_optional_null_image:
        Image:
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: low