An anomaly-based detection that flags outbound network connections from Python processes initiated from suspicious or non-standard directories to social media domains. It relies on Sysmon Event ID 3 (network connections) and correlates the process image/path with the process name (py.exe, python.exe, python2*.exe, python3*.exe, pythonw.exe) and destination domains (facebook.com, facebook.net, facebook.org, fb.com, fbcd.net, fbsbx.com, fbstatic-a.akamaihd.net, tfbw.net). The rule renames Image to process_path, calculates first/last observed times, and aggregates results by various fields to surface an anomalous outbound connection. The intent is to detect Python-based malware or credential-harvesting activity that runs from non-standard directories (e.g., Recycle Bin, Windows fonts, Windows debug folders, public user folders) and communicates with social media infrastructure. It references MITRE ATT&CK technique T1586.001 and uses an analytic narrative inspired by the Braodo Stealer case to illustrate how adversaries may leverage social media endpoints. The detection is targeted at Windows/Endpoint telemetry and is intended for Splunk Enterprise/Splunk ES/Cloud deployments. Implementation requires Sysmon logs with EventCode 3 and Sysmon TA version ≥ 6.0.4. There are no known false positives documented at this time.