diff --git a/rules/windows/image_load/image_load_clfs_load.yml b/rules/windows/image_load/image_load_clfs_load.yml
new file mode 100644
index 000000000..9e615a91c
--- /dev/null
+++ b/rules/windows/image_load/image_load_clfs_load.yml
@@ -0,0 +1,41 @@
+title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
+id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
+status: experimental
+description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
+references:
+    - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
+    - https://x.com/Threatlabz/status/1879956781360976155
+author: X__Junior
+date: 2025-01-20
+tags:
+    - attack.execution
+    - attack.t1059
+logsource:
+    category: image_load
+    product: windows
+detection:
+    selection_dll:
+        ImageLoaded|endswith: '\clfs.sys'
+    selection_folders_1:
+        Image|contains:
+            - ':\Perflogs\'
+            - ':\Users\Public\'
+            - '\Temporary Internet'
+            - '\Windows\Temp\'
+    selection_folders_2:
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favorites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favourites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Contacts\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Pictures\'
+    condition: selection_dll and 1 of selection_folders_*
+falsepositives:
+    - Unknown
+level: medium
diff --git a/rules/windows/network_connection/net_connection_win_python.yml b/rules/windows/network_connection/net_connection_win_python.yml
index 6053c2409..ece5bc9bb 100644
--- a/rules/windows/network_connection/net_connection_win_python.yml
+++ b/rules/windows/network_connection/net_connection_win_python.yml
@@ -7,7 +7,7 @@ references:
     - https://pypi.org/project/scapy/
 author: frack113
 date: 2021-12-10
-modified: 2023-09-07
+modified: 2025-01-20
 tags:
     - attack.discovery
     - attack.t1046
@@ -35,6 +35,10 @@ detection:
         # This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
         DestinationIp: 127.0.0.1
         SourceIp: 127.0.0.1
+    filter_main_pip:
+        CommandLine|contains|all:
+            - 'pip.exe'
+            - 'install'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.
diff --git a/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml b/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
index 24463a9ab..9b7116b30 100644
--- a/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
+++ b/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
@@ -8,7 +8,7 @@ references:
     - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-01-02
-modified: 2023-02-17
+modified: 2025-01-20
 tags:
     - attack.execution
     - attack.t1059
@@ -24,13 +24,17 @@ detection:
               - 'python2.exe'
     selection_cli:
         CommandLine|contains: ' -c'
-    filter_python: # Based on baseline
+    filter_main_python: # Based on baseline
         ParentImage|startswith: 'C:\Program Files\Python'
         ParentImage|endswith: '\python.exe'
         ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
-    filter_vscode:
+    filter_optional_vscode:
         ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
-    condition: all of selection_* and not 1 of filter_*
+    filter_optional_pip:
+        CommandLine|contains|all:
+            - '<pip-setuptools-caller>'
+            - 'exec(compile('
+    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Python libraries that use a flag starting with "-c". Filter according to your environment
 level: medium