Suspicious Network Connection from PerfLogs Directory

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects network connections from processes executing from the PerfLogs directory, which is unusual and potentially suspicious. The PerfLogs directory is a default Windows directory intended for storing performance logs and not typically used for running executables. The fact that network connection is being made could hint that malware could be making connection to its C&C server. Adversaries often this directory to hide malware as it is often overlooked in monitoring and investigations.

2025-03-24 00:00:00

None

3c7c0cba-41f9-43dc-a783-f2efe39ae7f2

attack.command-and-control

Nextron Sigma feed only (private)