Audit hooks have a different use case. Here, in this article, we see described a way to package up the interpreter as part of the payload. This is very traditio

Audit hooks have a different use case. Here, in this article, we see described a way to package up the interpreter as part of the payload. This is very traditional malware, they 'bring their own binary' so to speak. A much more modern, and statistically far less common approach (say, top 15% of malware), wants to bring less to the system. Instead, they leverage existing mechanisms for execution - some of this is covered in LOLBAS (Living of the Land Binaries and Scripts). Interpreters such as Powershell, bash, Python, ruby, even perl, are used by attackers to run their payloads. There are a number of advantages. For one thing, if you're monitoring the system for new binary executions, it'll appear as just a Python interpreter - often quite normal on a number of systems. You also don't need to set any sort of execution rights, or drop executable files - just a regular, plain old python file. But the downside is now you're using the system's interpreter, and you have to follow the interpreter's rules. Powershell really kicked this approach off since it was a favorite of malware authors, and Python followed suit with this. As a much newer implementation, with 3.8 being an extremely recent release, it's not so surprising that there are bypasses. Still, you'd be surprised how few attackers will take the time to do so (and how few orgs will monitor their Python interpreters anyways).