diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml
new file mode 100644
index 0000000000..eeb6f097b7
--- /dev/null
+++ b/detections/endpoint/python_network_traffic_during_package_build.yml
@@ -0,0 +1,112 @@
+name: Python Network Traffic During Package Build
+id: 03c9c504-2294-44da-8180-beefe1ca8ba8
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects a Python process making an outbound network connection during package installation.
+    Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
+    This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
+    If confirmed malicious, this could indicate a successful software supply chain compromise.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 3
+search: |-
+    `sysmon`
+    (
+        EventID=1
+        (
+            process="*_in_process.py*"
+            OR
+            process_name=python.exe
+        )
+    )
+    OR
+    (
+        EventID=3
+        dest_ip!=""
+        process_name=python.exe
+    )
+
+    | eval dest=if(EventID=3, Computer, dest)
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(dest_ip) as dest_ip
+                  values(dest_host) as dest_host
+
+      by dest source process_id
+
+    | search process="* build_wheel*"
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            dest_ip dest_host
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_network_traffic_during_package_build_filter`
+how_to_implement: |-
+    The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs
+    with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate
+    Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.
+known_false_positives: |-
+    Python packages may contact software repositories, mirror sites during build time.
+    Investigate the destination and package content to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A Python process [$process$] on [$dest$] made an outbound network connection to [$dest_ip$] with hostname [$dest_host$] during package installation.
+threat_objects:
+    - field: process
+      type: process
+    - field: dest_ip
+      type: ip_address
+    - field: dest_host
+      type: domain
+analytic_story:
+    - Malicious Python Package Installation
+    - Ingress Tool Transfer
+    - Command And Control
+    - Compromised Windows Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1195.002
+    - T1059.006
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/python_pth_file_creation_during_package_installation.yml b/detections/endpoint/python_pth_file_creation_during_package_installation.yml
new file mode 100644
index 0000000000..c7c514aee1
--- /dev/null
+++ b/detections/endpoint/python_pth_file_creation_during_package_installation.yml
@@ -0,0 +1,106 @@
+name: Python PTH File Creation During Package Installation
+id: bf581b86-39cd-48b7-9312-d9affb48a8bc
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
+    Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
+    This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 11
+search: |-
+    `sysmon`
+    EventID IN (1,11)
+    process_name="python.exe"
+    (
+        process="* install *"
+        OR
+        (
+            file_name="*.pth"
+            action="created"
+        )
+    )
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(file_name) as file_name
+                  values(file_path) as file_path
+                  dc(EventID) as dc_event_id
+
+      by dest source process_id
+
+    | search dc_event_id>1 AND process!="*-- setuptools*"
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            file_name file_path
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_pth_file_creation_during_package_installation_filter`
+how_to_implement: |-
+    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+    and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth
+    extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
+    Splunk Common Information Model (CIM).
+known_false_positives: |-
+    Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
+    Investigate the file contents and parent process to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 30
+          message: A Python .pth file called [$file_name$] located at [$file_path$] was created on [$dest$] during package installation using [$process$].
+threat_objects:
+    - field: process
+      type: process
+    - field: file_name
+      type: file_name
+    - field: file_path
+      type: file_path
+analytic_story:
+    - Malicious Python Package Installation
+    - Compromised Windows Host
+    - Windows Persistence Techniques
+asset_type: Endpoint
+mitre_attack_id:
+    - T1546
+    - T1195.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/python_pythonpath_modification_during_package_installation.yml b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml
new file mode 100644
index 0000000000..a314b6e63e
--- /dev/null
+++ b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml
@@ -0,0 +1,106 @@
+name: Python PYTHONPATH Modification During Package Installation
+id: 00f01ba4-df01-4caa-90f6-187e4563a516
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
+    Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
+    If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 13
+search: |-
+    `sysmon`
+    EventID IN (1,13)
+    (
+        parent_process="*\\site-packages\\pip\\*"
+        OR
+        (
+            registry_path="*PYTHONPATH"
+            action="modified"
+        )
+    )
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(registry_path) as registry_path
+                  values(registry_value_data) as registry_value_data
+                  dc(EventID) as dc_event_id
+
+      by dest source process_id
+
+    | search dc_event_id>1
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            registry_path registry_value_data
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_pythonpath_modification_during_package_installation_filter`
+how_to_implement: |-
+    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+    and registry modification (EventID 13) events, ensuring that registry modification events are collected for the
+    PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on
+    and normalize field names using the Splunk Common Information Model (CIM).
+known_false_positives: |-
+    Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
+    Investigate the new value and parent process to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$].
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: process
+      type: process
+    - field: registry_value_data
+      type: registry_value_data
+analytic_story:
+    - Malicious Python Package Installation
+    - Compromised Windows Host
+    - Windows Persistence Techniques
+    - Suspicious Windows Registry Activities
+    - Windows Registry Abuse
+asset_type: Endpoint
+mitre_attack_id:
+    - T1574.007
+    - T1195.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/python_site_hooks_creation_during_package_installation.yml b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml
new file mode 100644
index 0000000000..43b5a52eaf
--- /dev/null
+++ b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml
@@ -0,0 +1,107 @@
+name: Python Site Hooks Creation During Package Installation
+id: efaf40f5-779f-4b48-a941-b7d1a7c931ed
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
+    Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
+    If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
+    The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
+data_source:
+    - Sysmon EventID 1 AND Sysmon EventID 11
+search: |-
+    `sysmon`
+    EventID IN (1,11)
+    (
+        process="* install *"
+        OR
+        (
+            action="created"
+            file_path="*-packages\\*"
+            file_path IN ("*sitecustomize.py", "*usercustomize.py")
+        )
+    )
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+                  values(parent_process_id) as parent_process_id
+                  values(parent_process_path) as parent_process_path
+                  values(parent_process_name) as parent_process_name
+                  values(parent_process) as parent_process
+                  values(process_path) as process_path
+                  values(process_name) as process_name
+                  values(process) as process
+                  values(file_path) as file_path
+                  values(file_name) as file_name
+                  dc(EventID) as dc_event_id
+                  by dest source process_id
+
+    | search dc_event_id>1
+
+    | table firstTime lastTime
+            parent_process_id parent_process_path parent_process_name parent_process
+            process_id process_path process_name process
+            file_path file_name
+            dest source
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `python_site_hooks_creation_during_package_installation_filter`
+how_to_implement: |-
+    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+    and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py
+    extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
+    Splunk Common Information Model (CIM).
+known_false_positives: |-
+    Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py`
+    as part of normal setup. Investigate the file contents and parent process to determine legitimacy.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: A Python site hook file [$file_path$] was created on [$dest$] during package installation using [$process$].
+    entity:
+        field: dest
+        type: system
+        score: 40
+threat_objects:
+    - field: process
+      type: process
+    - field: file_path
+      type: file_path
+    - field: file_name
+      type: file_name
+analytic_story:
+    - Malicious Python Package Installation
+    - Compromised Windows Host
+    - Windows Persistence Techniques
+asset_type: Endpoint
+mitre_attack_id:
+    - T1546
+    - T1195.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/stories/malicious_python_package_installation.yml b/stories/malicious_python_package_installation.yml
new file mode 100644
index 0000000000..d7d6635781
--- /dev/null
+++ b/stories/malicious_python_package_installation.yml
@@ -0,0 +1,28 @@
+name: Malicious Python Package Installation
+id: 12e51c50-6b66-4ce7-83b8-95125ffd31e9
+version: 1
+creation_date: '2026-08-21'
+modification_date: '2026-08-21'
+author: Onur Mustafa Erdogan, Splunk
+status: production
+description: |-
+    This analytic story provides detection coverage for abuse of the Python package installation lifecycle, including install-time code execution, persistence via `.pth` path configuration files, Python site hooks, and PYTHONPATH environment variable manipulation.
+narrative: |-
+    Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure.
+    Malicious packages and supply-chain attacks exploit the trust built into Python's packaging ecosystem to execute payloads at the moment of installation, without any direct interaction from the victim. Adversaries abuse several native Python features to achieve this.
+    `setup.py` build scripts can leverage `distutils`/`setuptools` command classes to execute arbitrary code, including
+    network beacons, during package installation.
+    Path configuration files (`.pth`) placed in `site-packages`/`dist-packages` are executed on every subsequent Python invocation, providing persistence; this technique was used by the threat actor group TeamPCP during the supply-chain compromise of the `litellm` package. Python's `site` module also loads `sitecustomize.py` and `usercustomize.py` hook files from directories on `sys.path`, which adversaries can plant or manipulate to hijack the Python environment and achieve persistence, as seen with the VIPERTUNNEL backdoor. 
+    Finally, adversaries who can modify a user's `PYTHONPATH` environment variable can redirect module imports to attacker-controlled directories,achieving user-level persistence across new shell sessions.
+    This story detects these behaviors by correlating process creation, file creation, and registry modification telemetry around Python package installation activity.
+references:
+    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
+category:
+    - Adversary Tactics
+usecase: Advanced Threat Detection
+threat_group:
+    - TeamPCP
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud