Python Process Loading python20.dll

Daniel Jeremiah@daniyyell

•updated Mar 7, 2026•3•0•70

This rule detects instances where a Python process loads the 'python20.dll' file. This activity is suspicious because 'python20.dll' is an older Python 2 library, and its loading by a Python process in modern environments may indicate a sideloading technique. This could be indicative of an attacker using Python as a cover to load malicious helper files for reconnaissance, tunneling, or other post-exploitation activities.