CL-UNK-1068 Python Sideload python20.dll
This rule looks for a Python process loading a helper file called python20.dll, which was part of the toolset used in the CL-UNK-1068 activity. The rule is useful because it combines two details that are not common together in modern normal use: a current Python process and an old helper file name used as a loading trick. It does not try to flag every Python action or every helper file, which helps reduce noise. In plain language, the rule is meant to catch a hidden helper attached to Python that can be used to start other attacker tools while blending in with a familiar program name. When this match appears, it can point to scanning, hidden connections, or other follow-on activity described in the campaign. The focus on the exact file name helps keep the match useful and lowers the chance of confusing it with ordinary Python use.
Sigma
