This anomaly rule detects a Python process making an outbound network connection during the installation or build phase of a Python package. Attackers can abuse setup.py and build scripts (via distutils/setuptools) to execute arbitrary code as part of a package install, potentially beaconing to external domains or exfiltrating data. The detection targets Windows endpoints by leveraging Sysmon events: EventID 1 (process creation) to capture Python-related processes (e.g., python.exe or *_in_process.py) and EventID 3 (network connection) to identify outbound communications. The search correlates the build process with network activity, filtering for build-related commands (e.g., build_wheel), and gathers context such as destination IP/host, process paths/names, and parent process information. When a correlation is found, the rule surfaces an enrichment with first/last times, destinations, and involved processes. MITRE ATT&CK mappings include T1195.002 (Supply Chain: Compromise Software) and T1059.006 (Command and Scripting Interpreter: Python), aligning to a scenario where malicious code is executed during package installation. The rule notes a potential risk in legitimate environments where Python packages contact repositories during builds, advising validation of the destination and package contents to rule out false positives. This analytic supports endpoint security monitoring and threat hunting for software supply chain compromises during Python packaging activities, and is suitable for Splunk deployments using Sysmon data normalized via CIM. Key telemetry includes the detected Python process, its outbound destination, and the build context, enabling rapid investigation into suspected malicious package installations and potential post-exploitation activity on the host.