Date: 08/09/2024
Severity: Medium
Summary
Detects the loading of "Python Core" by a non-Python process, which could indicate the presence of a Python script packaged with Py2Exe.
Indicators of Compromise (IOC) List
Description | 'Python Core' |
Image | 'Python' 'C:\Program Files\' 'C:\Program Files (x86)\' 'C:\ProgramData\Anaconda3\' null |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | ((resourceName = "Sysmon" AND eventtype = "7" ) AND description = "Python Core" ) AND imageloaded not in ("C:\Program Files" , "C:\Program Files (x86)" , "C:\ProgramData\Anaconda3" , "Python" , "null") |
Detection Query 2 | ((technologygroup = "EDR" ) AND description = "Python Core" ) AND imageloaded not in ("C:\Program Files" , "C:\Program Files (x86)" , "C:\ProgramData\Anaconda3" , "Python" , "null") |
Reference:
Sigma Detection Rule for Suspicious Python Image Loading
Py2exe Official Website
Unit 42 Technical Analysis of SeaDuke