Komari C2 - Agent Binary Anomalous Path Execution (T1036.005)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.