LegionLoader C2 Communication to birdeemusic.com via _socket.pyd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potential command and control (C2) activity by identifying specific DNS queries to known malicious domains or suspicious network-related processes executing on an endpoint. It flags DNS requests for 'birdeemusic.com' and network connections initiated by processes with names indicative of custom or potentially malicious payloads like '_socket.pyd' or 'Traiolx Custom Utils'.