Komari C2 - Agent Spawning Interactive Discovery Shells (T1059.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Identifies the Komari agent process acting as a parent to cmd.exe or powershell.exe which then execute typical post-exploitation discovery commands. This detection correlates process creation events with network events to ensure the initiating process also has network activity, reducing false positives.