Potential Injection via PyInstaller Executable

api where not process.code_signature.status : "trusted" and
 (
 (process.Ext.api.behaviors : ("shellcode", "allocate_shellcode", "execute_shellcode") and
  process.thread.Ext.call_stack_summary :
                      ("ntdll.dll
| kernelbase.dll
| Unbacked",
                       "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                       "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                       "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| libffi-?.dll
| _ctypes.pyd
| *") and
  process.thread.Ext.call_stack_final_user_module.protection_provenance : "libffi*.dll" and
  process.thread.Ext.call_stack_final_user_module.name : "Unbacked" and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*")) or

  (process.Ext.api.name : ("VirtualAlloc*", "MapViewOfFile*") and process.Ext.api.parameters.protection : "RWX" and
   process.thread.Ext.call_stack_final_user_module.name : "libffi*.dll" and
   process.thread.Ext.call_stack_summary : ("ntdll.dll
| kernelbase.dll
| libffi-?.dll
| _ctypes.pyd
| *",
                                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| libffi-?.dll
| _ctypes.pyd
| *"))
 ) and
 not process.Ext.api.summary == "VirtualAlloc( NULL, 0x1c, COMMIT
| RESERVE, RWX )"