Portable Python Execution in Public Folder

Ibrahim Saud@tektrix

•updated Jun 19, 2026•2•0•12

Detects the execution of the Python interpreter (python.exe) from within the globally writable C:\Users\Public\ directory. Threat actors often drop bundled Python environments to bypass the requirement for a pre-installed interpreter when running Python-based malware, such as information stealers.