Potential Python DLL SideLoading

Title: Potential Python DLL SideLoading
Status: test
Description:Detects potential DLL sideloading of Python DLL files.
References:
  -https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/
  -https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
  -https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
Author: Swachchhanda Shrawan Poudel
Date: 2024-10-06
modified:2025-08-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith:
      -'\python39.dll'
      -'\python310.dll'
      -'\python311.dll'
      -'\python312.dll'

  filter_main_default_install_paths:
    - ImageLoaded|startswith:
      - 'C:\Program Files\Python3'
      - 'C:\Program Files (x86)\Python3'
ImageLoaded|contains:'\AppData\Local\Programs\Python\Python3'   filter_optional_visual_studio:
    ImageLoaded|startswith: 'C:\Program Files\Microsoft Visual Studio\'
  filter_optional_anaconda:
    ImageLoaded|startswith: 'C:\ProgramData\Anaconda3\'
  filter_optional_cpython:
    ImageLoaded|contains:
      -'\cpython\externals\'
      -'\cpython\PCbuild\'

  filter_optional_pyinstaller:
    ImageLoaded|startswith: 'C:\Users'
    ImageLoaded|contains: '\AppData\Local\Temp\_MEI'
  filter_main_legit_signature_details:
    Product: 'Python'
    Signed: 'true'
    Description: 'Python'
    Company: 'Python Software Foundation'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate software using Python DLLs
Level: medium