Windows Renamed Python Binary was Executed — Detection Rule
The following analytic identifies a Python process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.