Detect PE file produced by pyinstaller

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging PyInstaller to package malicious Python scripts into standalone executables, thereby evading script-based detection mechanisms and simplifying lateral movement. Proactive hunting for these artifacts in Azure Sentinel is critical because while the rule severity is low, the presence of unexpected PyInstaller-generated PE files often signals early-stage reconnaissance or a sophisticated attempt to bypass traditional endpoint security controls.

YARA Rule

rule PE_File_pyinstaller
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
        description = "Detect PE file produced by pyinstaller"
        reference = "https://isc.sans.edu/diary/21057"
    strings:
        $a = "pyi-windows-manifest-filename"
    condition:
        pe.number_of_resources > 0 and $a
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://isc.sans.edu/diary/21057
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detect PE file produced by PyInstaller” rule, including suggested filters and exclusions:

• Internal IT Automation Scripts Execution

  • Scenario: The IT Operations team frequently deploys custom Python-based configuration management tools (e.g., scripts wrapping Ansible or Puppet agents) that are compiled into standalone .exe files using PyInstaller. These run automatically on endpoints during maintenance windows, generating new PE files identical to the rule’s signature.
  • Filter/Exclusion: Add an exclusion for processes originating from specific trusted administrative accounts (e.g., DOMAIN\IT_Ops_Svc) or restrict the detection scope to exclude file paths within the designated deployment folder (e.g., C:\ProgramData\InternalTools\Deployments\).

• Third-Party SaaS Client Installations

  • Scenario: Enterprise-wide rollout of a proprietary customer support or ticketing client (such as a custom wrapper for ServiceNow or Zendesk) that is distributed to end-users. The installer creates a PyInstaller-based executable in the user’s local application data directory upon first launch, triggering the rule repeatedly during onboarding.
  • Filter/Exclusion: Create an exclusion based on known vendor file hashes (SHA-256) for these specific third-party applications and exclude any PE files located within C:\Program Files\[VendorName]\ or %LOCALAPPDATA%\[VendorName]\.

• Scheduled Data Backup and Reporting Jobs

  • Scenario: A scheduled task running daily at 02:00 AM executes a Python-based data aggregation tool (e.g., a custom PowerShell/Python hybrid script) that compiles reports from SQL databases. This job generates a temporary PyInstaller executable to process large datasets before cleaning up, causing the rule to fire during every