Potential Python DLL Sideloading
Detects potential DLL sideloading of Python DLL files (python39.dll, python310.dll, python311.dll, python312.dll) by monitoring image load events. The rule filters out legitimate loads from common Python installation paths, Visual Studio, Anaconda, CPython build paths, and PyInstaller bundled applications, as well as legitimately signed Python DLLs, to reduce false positives.
Sigma
