LegionLoader _socket.pyd C2 Module Staged in AppData\Roaming Non-Standard Directory
Detects the LegionLoader malware staging its Python-based C2 module named _socket.pyd within non-standard directories in the AppData\Roaming path. This behavior is indicative of a persistence or execution staging mechanism where the malware attempts to hide its components in user-writable directories while avoiding standard Python installation paths.
Sigma
