C2 payload staged in %TEMP% launched via format-specific handler or attrib.exe n

Ibrahim Saud@tektrix

•updated Sep 26, 2026•2•0•4

This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.