This analytic detects the creation of Python startup hook files (sitecustomize.py or usercustomize.py) within a site-packages or dist-packages directory during a package installation process. Python’s site module loads these hooks from sys.path directories before code executes, so an attacker who places or modifies one of these files can hijack the Python environment and execute code with every Python invocation, enabling persistence on the host. The rule references observed activity related to VIPERTUNNEL’s abuse of site hooks to trigger DLL execution, illustrating how such hooks can be used for arbitrary code execution on Python startup. The detection relies on correlating process activity indicative of installation with file creation events targeting Python hook filenames in package directories, flagging suspicious modifications during software deployment or updates.