Detecting AI-Assisted C2 Operations: PowerShell Polling Agents and Gemini CLI Signatures

Trend Micro’s July 2026 analysis of threat actor “bandcampro” introduced a detection challenge that sits awkwardly between traditional C2 hunting and AI threat detection. The actor used jailbroken Gemini CLI as an autonomous operator — architecting, deploying, and debugging C2 infrastructure with the AI doing roughly 89% of the work. The resulting malware was technically unremarkable: a lightweight Python HTTP server and PowerShell agents with no obfuscation, no evasion, and no particularly clever tradecraft.

Which is exactly why it matters for detection. The artifact signature is clean, the behaviour is consistent, and the same architecture will be replicated by other low-skill actors using AI coding assistants. Understanding what this looks like in logs is worth doing now.

The C2 Architecture

Bandcampro’s Gemini-designed C2 infrastructure had these components:

• Server side: An in-memory Python HTTP server running on the compromised host or attacker-controlled VPS. No disk-persistent binary, no service installation.
• Agent side: PowerShell agents on victim machines polling the C2 server at a fixed 5-second interval via HTTP GET.
• Persistence: Scheduled tasks (Windows Task Scheduler) and WMI event subscriptions to restart the agent after reboot. Registry run key modifications as a third persistence layer.
• Total footprint: Three plain-text files, approximately 5KB.

The polling interval is the primary detection handle. A 5-second polling cadence from PowerShell to an HTTP endpoint is not how legitimate software behaves. This is aggressive enough to be distinctive without being so aggressive it immediately triggers rate-limit style detections.

Detection 1: High-Frequency PowerShell Outbound HTTP Polling

PowerShell making outbound HTTP requests at short, regular intervals is the clearest signal. Most legitimate PowerShell-based tooling and scripts don’t poll external HTTP endpoints at sub-10-second intervals.

title: PowerShell High-Frequency HTTP Polling (AI-Assisted C2 Pattern)
id: 7a3f1c2b-8e4d-4a1b-9c5f-2d6e8b3a7f0c
status: experimental
description: Detects PowerShell processes making repeated HTTP connections at high frequency, consistent with AI-generated polling-based C2 agents observed in bandcampro campaign
references:
  - https://www.trendmicro.com/en_us/research/26/g/gemini-cli-botnet.html
author: SOC Analyst Hub
date: 2026/07/21
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    Initiated: 'true'
    DestinationPort:
      - 80
      - 8080
      - 8000
      - 4444
      - 443
  timeframe: 60s
  condition: selection | count() by SourceIp, DestinationIp, DestinationPort > 6
falsepositives:
  - Monitoring scripts with short polling intervals (validate against known asset inventory)
  - Windows Update checking mechanisms (though these don't typically use PowerShell direct HTTP)
level: high

For the 5-second interval specifically, 6+ connections in 60 seconds from the same PowerShell process to the same destination is a reliable threshold. Adjust downward if your environment has high PowerShell HTTP activity.

Detection 2: Scheduled Task Creating PowerShell with Network Activity

The persistence mechanism — scheduled tasks restarting the PowerShell agent — creates a detectable event sequence: a scheduled task creation event followed by a PowerShell process with outbound network connections.

title: Scheduled Task Spawning PowerShell with Immediate Network Connection
id: 9b2e5d4a-1f7c-4b8e-a3d6-5c9f2e1a8b7d
status: experimental
description: Detects scheduled task creation (Event 4698) followed by PowerShell network activity, consistent with AI-generated C2 agent persistence installation
author: SOC Analyst Hub
date: 2026/07/21
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.command_and_control
  - attack.t1071.001
logsource:
  product: windows
  service: security
detection:
  task_creation:
    EventID: 4698
    TaskContent|contains:
      - 'powershell'
      - 'pwsh'
  near:
    EventID: 5156
    Application|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  timeframe: 30s
  condition: task_creation and near
falsepositives:
  - Legitimate administrative automation that uses scheduled PowerShell tasks with network activity
level: medium

Detection 3: WMI Event Subscription for PowerShell Persistence

The third persistence mechanism used in this campaign — WMI event subscriptions — leaves queryable artifacts in the WMI repository and generates Windows event log entries.

title: WMI Event Subscription Installing PowerShell Persistence
id: 3c7a9f1e-6d4b-4c2a-8e5f-1b7d3a9c5f2e
status: experimental
description: Detects WMI EventFilter and CommandLineEventConsumer creation targeting PowerShell, consistent with AI-generated C2 persistence patterns
author: SOC Analyst Hub
date: 2026/07/21
tags:
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  service: microsoft-windows-wmi-activity/operational
detection:
  selection:
    EventID:
      - 5857
      - 5858
      - 5859
      - 5860
    Message|contains:
      - 'powershell'
      - 'CommandLineEventConsumer'
  condition: selection
falsepositives:
  - Legitimate WMI-based monitoring solutions
level: high

KQL for Microsoft Sentinel

For Sentinel environments, correlating network connection frequency from PowerShell processes across a 5-minute window:

// Detect PowerShell high-frequency HTTP polling (AI-assisted C2 pattern)
let threshold = 20; // connections per 5 minutes
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemotePort in (80, 8080, 8000, 4444, 443)
| where ActionType == "ConnectionSuccess"
| summarize 
    ConnectionCount = count(),
    DestinationIPs = make_set(RemoteIP),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, bin(Timestamp, 5m), RemoteIP, RemotePort
| where ConnectionCount >= threshold
| project-reorder Timestamp, DeviceName, ConnectionCount, RemoteIP, RemotePort, FirstSeen, LastSeen
| sort by ConnectionCount desc

For correlating the full kill chain (scheduled task creation → PowerShell spawn → network polling):

// Correlate scheduled task persistence with subsequent PowerShell C2 polling
let SuspiciousTasks = DeviceEvents
| where ActionType == "ScheduledTaskCreated"
| where AdditionalFields has "powershell" or AdditionalFields has "pwsh"
| project DeviceName, TaskTime = Timestamp, TaskName = AdditionalFields;

let PSNetworkActivity = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemotePort in (80, 8080, 8000, 4444, 443)
| summarize ConnectionCount = count() by DeviceName, bin(Timestamp, 5m), RemoteIP
| where ConnectionCount >= 10;

SuspiciousTasks
| join kind=inner (PSNetworkActivity) on DeviceName
| where Timestamp between (TaskTime .. (TaskTime + 30m))
| project DeviceName, TaskTime, TaskName, Timestamp, RemoteIP, ConnectionCount

Threat Hunting Query: Memory-Resident Python HTTP Servers

The server side of this architecture — Python running an HTTP server without writing a file to disk — is harder to detect through file creation events but visible through process behaviour:

// Hunt for Python processes serving HTTP without corresponding script file on disk
DeviceProcessEvents
| where FileName in~ ("python.exe", "python3", "python3.12")
| where ProcessCommandLine has_any ("http.server", "HTTPServer", "BaseHTTPServer", "SimpleHTTPRequestHandler")
| where not(ProcessCommandLine has_any (".py"))  // No script file argument
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

What These Alerts Tell You

A hit on the high-frequency PowerShell polling rule is worth treating as high-fidelity — there are very few legitimate reasons for PowerShell to HTTP-poll an endpoint at 5-second intervals. The WMI and scheduled task persistence rules have more false positives from legitimate automation; context matters. Pivot to the host for process lineage, check whether the scheduled task has a recognisable name and description, and look for the small artifact footprint (sub-10KB three-file structure) Trend Micro documented.

The absence of obfuscation is actually useful here. You’re looking for readable PowerShell that makes HTTP GET requests in a loop, not encoded or obfuscated payloads. Standard SIEM keyword matching on PowerShell command line for while($true) combined with Invoke-WebRequest or WebClient patterns catches the pattern before you even need the network telemetry.