Sigma rule: Python Image Load By Non-Python Process

Rule

Title

Python Image Load By Non-Python Process

Status

test

Level

low

Author

Patrick St. John, OTR (Open Threat Research)

Date

2020-05-03

Modified

2025-08-18

File

rules/windows/image_load/image_load_susp_python_image_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.
Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.
Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.

Log source

product

windows

category

image_load

Detection

selection:
    Description: 'Python Core'
filter_main_generic:
    - Image|contains: 'Python'  # FPs with python38.dll, python.exe etc.
    - Image|startswith:
          - 'C:\Program Files\'
          - 'C:\Program Files (x86)\'
          - 'C:\ProgramData\Anaconda3\' # Comment out if you don't use Anaconda in your environment
filter_optional_null_image:
    Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate Py2Exe Binaries
• Known false positive caused with Python Anaconda
• Various legitimate software is bundled from Python code into executables

Tags

• attack.stealth
• attack.t1027.002

MITRE ATT&CK ids this rule names

• T1027.002

References

• https://www.py2exe.org/
• https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_susp_python_image_load.yml