LegionLoader _socket.pyd Staged in Traiolx Custom Utils for Python C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.