BraZetsu Python Malware: Detection and Remediation Guide for Windows Environments — IAB Toolkit Turns Compromised Hosts Into Marketplace Inventory

---
title: Suspicious Python Execution From User-Writable Paths
id: 3f8a1c92-7b5e-4d21-9f63-a2c8e4b1d907
status: experimental
description: Detects python.exe or pythonw.exe executing scripts or inline code from user-writable directories commonly abused by Python-based malware frameworks such as BraZetsu for staging and execution.
references:
  - https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\AppData\Local\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_known_good:
    CommandLine|contains:
      - '\AppData\Local\Programs\Python'
      - '\AppData\Local\Microsoft\WindowsApps'
      - 'pip install'
  condition: selection_image and selection_path and not filter_known_good
falsepositives:
  - Developer workstations running ad-hoc Python scripts
  - Legitimate tools that bundle a private Python runtime (baseline per host role)
level: high
---
title: PyInstaller Runtime Artifact Extraction in Temp
id: 8c2d5f14-3a91-4e78-b6d0-5f2a9c3e8174
status: experimental
description: Detects creation of PyInstaller onefile extraction directories (_MEI*) under the temp folder, a hallmark of frozen Python executables used by BraZetsu-class frameworks to deliver self-contained implants.
references:
  - https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Temp\_MEI'
  condition: selection
falsepositives:
  - Legitimate PyInstaller-packaged internal utilities (allowlist by hash and signer)
level: medium
---
title: Persistence Run Key Pointing to Python Payload
id: 61b9e4a7-c2f0-4d35-88a1-9d4e7b5c2063
status: experimental
description: Detects registry Run/RunOnce persistence values invoking python.exe, pythonw.exe, or executables staged in user-writable paths, consistent with BraZetsu's need to preserve sellable access across reboots.
references:
  - https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html
  - https://attack.mitre.org/techniques/T1060/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.persistence
  - attack.t1060
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_payload:
    Details|contains:
      - 'python.exe'
      - 'pythonw.exe'
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
  condition: selection_key and selection_payload
falsepositives:
  - Rare; legitimate software almost never persists Python payloads via Run keys from user-writable paths
level: high

// Hunt 1: Python processes with suspicious command lines or rare outbound connections
let Lookback = 7d;
let SuspiciousPython = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("python.exe", "pythonw.exe")
| where ProcessCommandLine has_any ("AppData", "ProgramData", "Public", "-c ", "base64")
   or FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\Users\\Public\\")
| project DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, ProcessCreationTime=Timestamp, ProcessId;
SuspiciousPython
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("python.exe", "pythonw.exe")
    | where RemoteIPType == "Public"
    | project DeviceName, ProcessId, RemoteUrl, RemoteIP, RemotePort, ConnectionTime=Timestamp
) on DeviceName, ProcessId
| project DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ProcessCreationTime
| order by DeviceName asc, ProcessCreationTime desc;

// Hunt 2: Scheduled tasks or Run-key persistence invoking Python from user-writable paths
DeviceRegistryEvents
| where Timestamp > ago(Lookback)
| where RegistryKey has_any ("\\CurrentVersion\\Run", "\\CurrentVersion\\RunOnce")
| where RegistryValueData has_any ("python", "\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\")
| project DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, Timestamp
| order by Timestamp desc;

-- BraZetsu hunt: rogue Python processes, persistence entries, and PyInstaller artifacts
SELECT * FROM foreach(
    row={
        SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
        FROM pslist()
        WHERE Name =~ '(?i)python(w)?\\.exe'
          AND (CommandLine =~ '(?i)(appdata|programdata|users\\\\public|\\\\-c\\\\s|base64)'
               OR Exe =~ '(?i)(appdata|programdata)')
    },
    query={
        SELECT Pid, Name, Exe, CommandLine, Username, CreateTime FROM scope()
    })

-- Persistence sweep: Run keys referencing Python or user-writable payload paths
SELECT FullPath, Name AS ValueName, String.value AS ValueData
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*', accessor='registry')
WHERE String.value =~ '(?i)(python|appdata\\\\roaming|local\\\\temp|users\\\\public)'

-- PyInstaller extraction directories left behind by frozen implants
SELECT FullPath, Mtime, Size
FROM glob(globs='C:/Users/*/AppData/Local/Temp/_MEI*/*')
ORDER BY Mtime DESC

# BraZetsu Triage & Containment Script — run elevated on suspect hosts
$Report = "C:\IR\BraZetsu_Triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
New-Item -Path 'C:\IR' -ItemType Directory -Force | Out-Null

# 1. Audit Run/RunOnce persistence for Python payloads and user-writable paths
"=== RUN KEY PERSISTENCE ===" | Out-File $Report
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Value -match 'python|AppData\\Roaming|AppData\\Local\\Temp|Users\\Public'
      } | ForEach-Object { "$key :: $($_.Name) = $($_.Value)" | Out-File $Report -Append }
    }
  }
}

# 2. Enumerate scheduled tasks invoking Python or binaries in user-writable paths
"=== SCHEDULED TASKS ===" | Out-File $Report -Append
Get-ScheduledTask | ForEach-Object {
  $task = $_
  $task.Actions | Where-Object {
    $_.Execute -match 'python' -or $_.Execute -match 'AppData|Users\\Public' -or $_.Arguments -match 'python|AppData'
  } | ForEach-Object { "$($task.TaskPath)$($task.TaskName) -> $($_.Execute) $($_.Arguments)" | Out-File $Report -Append }
}

# 3. List live Python processes with full command lines
"=== LIVE PYTHON PROCESSES ===" | Out-File $Report -Append
Get-CimInstance Win32_Process | Where-Object {
  $_.Name -match '^python(w)?\.exe$'
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List | Out-File $Report -Append

# 4. Find PyInstaller extraction artifacts in user temp folders
"=== PYINSTALLER ARTIFACTS ===" | Out-File $Report -Append
Get-ChildItem 'C:\Users\*\AppData\Local\Temp\_MEI*' -Directory -ErrorAction SilentlyContinue |
  Select-Object FullName, CreationTime, LastWriteTime | Format-List | Out-File $Report -Append

# 5. Quarantine action: kill Python processes running from user-writable paths (review report first)
# Uncomment only after validating results in $Report
# Get-CimInstance Win32_Process | Where-Object {
#   $_.Name -match '^python(w)?\.exe$' -and $_.ExecutablePath -match 'AppData|Users\\Public'
# } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }

Write-Host "Triage complete. Review $Report before taking containment action."