Python PTH File Creation During Package Installation — Detection Rule
The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process. Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type. This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.