Komari C2 - Service Installation for Persistence (T1543.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•2

Detects the creation of a Windows Service pointing to a suspected Komari agent binary in a non-standard directory (Public, ProgramData, or Temp) to survive reboots. This rule specifically looks for 'sc.exe' being used with the 'create' command and a 'binPath' argument that includes one of the specified directories and ends with '.exe'.