PS1Bot C2 Polling via Drive Serial

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•3

Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.