LegionLoader Python C2 Module Executing from AppData or Temp with Outbound Network

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects Python processes executing from suspicious locations like AppData or Temp folders that also establish outbound network connections. This behavior can indicate the execution of malicious Python scripts, often associated with malware, initial access, or command and control activities.