Detects suspicious modification of the PYTHONPATH environment variable in the context of a Python package installation. The analytic monitors Windows Sysmon events, specifically Event IDs 1 (process creation) and 13 (registry modification). It triggers when the parent process resembles a pip/site-packages path or when a registry path matching PYTHONPATH is modified, correlating process and registry data to identify potential hijacking of Python's module search path. A successful modification can cause Python to import attacker-controlled modules, enabling user-level persistence and potential code execution on subsequent Python invocations. The rule is implemented as a Splunk search that aggregates metrics by destination/source and process/registry details, and is labeled by a dedicated detection filter. The finding emphasizes the risk of Python path hijacking during package installation and provides guidance for investigation and containment.