Pupy is yet another open-source RAT/C2 framework.

Pupy is a cross-platform, multi function RAT and post-exploitation tool mainly written in python. It features an all-in-memory execution guideline and leaves a very low footprint. Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory.

https://github.com/n1nj4sec/pupy

I have encountered this used at attack/defend CTFs. This rule finds these implants.

rule pupy
{
	meta:
		description = "https://github.com/n1nj4sec/pupy"

	strings:
		$a = "pupy.error"
		$b = "get_pupy_config"

	condition:
		all of them
}

YARA Rules Index