Python PYTHONPATH Modification During Package Installation — Detection Rule
The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process. Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules. If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions. If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.