LegionLoader: python.exe C2 Communication via Traiolx Custom Utils _socket.pyd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances of the Python interpreter (python.exe) executing from the AppData\Roaming directory, which is a common persistence location for malware. It further correlates these process events with outbound network connections to external (non-private/non-RFC1918) IP addresses, identifying potential Command and Control (C2) or data exfiltration activity.