C2Looper v2 'ls'/'drives' backdoor command execution

Emiliano Mema@Nosalva

•updated Aug 19, 2026•1•0•5

Detects the execution of commands 'ls' or 'drives' via command line, which are often used by threat actors for reconnaissance and file/directory enumeration on a compromised host.