BirdCall Executes an Operator Shell Command

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•8

Detects a game-delivered backdoor spawning cmd.exe with a command line unrelated to installation or game launch activity. The rule specifically looks for cmd.exe being spawned by processes with names containing 'bird', 'rok', 'game', 'launcher', 'update', 'python', or 'ruby', and executing a command line with '/c'.