I frequently encounter malware written in Python that has been turned into an executable with pyinstaller. This allows the malware to run whether or not a Python interpreter or the software’s dependencies have been installed on the victim host.

This rule will find many of these samples but does not guarantee that matches are malicious.

rule pyinstaller
{
	meta:
		description = "https://www.pyinstaller.org/"

	strings:
		$a = "_MEIPASS"

	condition:
		all of them
}

YARA Rules Index