LegionLoader birdeemusic.com C2 Beacon with AppData/msiexec Precursor

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potential C2 beaconing activity associated with LegionLoader by monitoring for outbound network connections to 'birdeemusic.com' domains initiated by Python or AppData/Roaming-based processes, following a precursor process launch (msiexec.exe or from AppData/Roaming) on the same host within 10 minutes.