LegionLoader Python C2 via _socket.pyd in Traiolx Custom Utils

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.