Rule Info
Name
SUSP_PY_Import_Encoding_Aug26
Author
Marius Benthin
Description
Detects suspicious encodings of Python's import keyword
Score
70
Reference
Internal Research
Date
2026-08-31
Minimum Yara
3.5.0
Rule Hash
6606111d9c314b3e462de59e20246368
Tags
['T1059_006', 'SCRIPT', 'SUSP']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
11
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR