This analytic detects the covert creation of Python path configuration files (.pth) during a package installation, a persistence technique that leverages Python’s startup behavior. When a .pth file is placed under site-packages or dist-packages, Python loads and executes it on every invocation, enabling attacker-controlled code to run repeatedly. The rule targets the combination of a Python process performing a package install and the creation of a .pth file, which aligns with observed techniques used by threat actor groups (e.g., TeamPCP during a supply chain compromise of the litellm package). It relies on Sysmon events (process creation and file creation) to capture both the installer activity and the emergence of a .pth file, and then correlates fields such as process path/name, parent process details, file path/name, and time windows. A filter excludes obvious legitimate noise (e.g., certain setuptools processes) to reduce false positives. If confirmed malicious, this technique could yield arbitrary code execution every time Python runs, regardless of installation method or distribution type, making it a significant persistence risk on the endpoint. The rule is designed for endpoint monitoring and integrates with Splunk’s CIM for normalization, delivering detailed context to aid incident response. False positives may occur from legitimate namespace packages or editable installs that create .pth files; each event should be validated by inspecting the file contents and the parent process to determine legitimacy. MITRE ATT&CK mappings include T1546 (Event Triggered Execution) and T1195.002 (Supply Chain Compromise: Code/Package Manipulation).