Local config.txt file staged for C2 configuration storage

Duo Tech@duotech

•updated Jul 6, 2026•8•0•7

Detects instances where a file named 'config.txt' is created, modified, or renamed. This pattern is commonly used by attackers to stage configuration files, drop payloads, or modify application settings.