LegionLoader: svchost.exe Repeated Anomalous External Connections via Injected DLL

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects instances where the Windows Service Host process (svchost.exe) initiates more than five network connections to external (non-private/non-local) IP addresses within a short timeframe. This behavior is often characteristic of command-and-control (C2) activity or beaconing by malicious code masquerading as or injecting into system services.