K
Low RiskWindowskodi.exeEXECUTABLEKodi Media Center - Entertainment Hub Analysis [2026]
Kodi is an open-source media center application. While primarily for entertainment, malicious add-ons can be used as attack vectors for malware distribution.
Risk Summary
## Risk Summary | Factor | Assessment | |--------|------------| | Detection Difficulty | Low | | Abuse Potential | Medium | | Prevalence | Common | | Risk Score | 30/100 | Kodi is a legitimate media center that can be compromised through malicious third-party add-ons.
Overview
What is kodi.exe?
Kodi (formerly XBMC) is a free and open-source media player application developed by the XBMC/Kodi Foundation.
Key Characteristics
| Attribute | Value |
|---|---|
| File Name | Kodi.exe |
| Developer | Kodi Foundation |
| Digital Signature | XBMC Foundation |
| Typical Size | 100-200 MB |
| Type | Media Center |
Technical Details
| Property | Description |
|---|---|
| Process Type | User Application |
| Network Activity | Media streaming, add-on downloads |
| Platform | Cross-platform |
| Extensions | Add-ons (Python-based) |
Kodi is highly extensible through add-ons, which is both a feature and a security concern.
Normal Behavior
Normal Behavior
Legitimate Usage Patterns
Kodi.exe (Main application)
kodi.exe -p (Portable mode)
kodi.exe --standalone (Fullscreen mode)
Expected Characteristics
| Aspect | Expected Behavior |
|---|---|
| Parent Process | explorer.exe |
| User Context | Current user |
| Network | Media sources, add-on repos |
| GPU Usage | Moderate (video playback) |
Common Network Activity
| Destination | Purpose |
|---|---|
| kodi.tv | Official updates |
| Add-on repositories | Extension downloads |
| Media sources | Streaming content |
| Local network | DLNA/UPnP |
Common Locations
C:\Program Files\Kodi\Kodi.exeC:\Program Files (x86)\Kodi\Kodi.exeSuspicious Indicators
Suspicious Indicators
Red Flags
| Indicator | Concern Level | Description |
|---|---|---|
| Unknown add-on repos | High | Third-party malicious sources |
| Python subprocess | Medium | Add-on executing code |
| Unusual network traffic | Medium | Non-media connections |
| Crypto mining | High | Cryptominer add-ons |
Malicious Add-on Indicators
Warning Signs:
- Add-ons from unknown repositories
- Add-ons requesting excessive permissions
- Unusual CPU usage during Kodi operation
- Network connections to mining pools
- Add-ons bundled with streaming boxes
Network Red Flags
| Pattern | Concern |
|---|---|
| Mining pool connections | Cryptominer |
| Tor/proxy traffic | Hidden activity |
| Unusual ports | C2 communication |
| Large data uploads | Exfiltration |
Abuse Techniques
Abuse Techniques
Malicious Add-ons
Add-on Attack Vector:
1. User installs third-party add-on repository
2. Malicious add-on downloaded from repo
3. Add-on executes Python code with user privileges
4. Malware installed via add-on
5. Persistence established
Cryptomining
Cryptominer Scenario:
1. Malicious Kodi repository added
2. "Media" add-on installed
3. Add-on downloads cryptominer
4. Miner runs during Kodi usage
5. CPU/GPU resources consumed
Botnet Participation
| Vector | Method |
|---|---|
| Add-on dropper | Add-on installs RAT |
| Repo compromise | Legitimate repo hijacked |
| Pre-loaded devices | Streaming boxes with malware |
| Update mechanism | Malicious update pushed |
DDoS Participation
Botnet Scenario:
1. Malicious add-on includes bot code
2. Bot connects to C2 server
3. Receives DDoS commands
4. Participates in attacks
5. User unaware of activity
Detection Guidance
Detection Guidance
Sysmon Configuration
<RuleGroup name="Kodi Monitoring" groupRelation="or">
<ProcessCreate onmatch="include">
<ParentImage condition="end with">Kodi.exe</ParentImage>
<Image condition="end with">python.exe</Image>
</ProcessCreate>
<NetworkConnect onmatch="include">
<Image condition="contains">Kodi</Image>
</NetworkConnect>
</RuleGroup>
Sigma Rule
title: Kodi Spawning Suspicious Process
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: '\Kodi.exe'
suspicious_child:
Image|endswith:
- '\python.exe'
- '\pythonw.exe'
- '\cmd.exe'
- '\powershell.exe'
condition: selection and suspicious_child
falsepositives:
- Legitimate add-on scripts
level: medium
KQL Query
// Kodi spawning processes
DeviceProcessEvents
| where InitiatingProcessFileName =~ "Kodi.exe"
| where FileName in~ ("python.exe", "cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
// Unusual Kodi network connections
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "Kodi.exe"
| where RemotePort in (4444, 5555, 6666, 8888) // Common malware ports
| project Timestamp, DeviceName, RemoteIP, RemotePort
Remediation Steps
Remediation Steps
Add-on Audit
# List installed add-ons
$addonPath = "$env:APPDATA\Kodi\addons"
if (Test-Path $addonPath) {
Get-ChildItem $addonPath -Directory | Select Name
}
# Check for suspicious Python scripts
Get-ChildItem "$env:APPDATA\Kodi" -Recurse -Filter "*.py" |
Select FullName, LastWriteTime
Repository Review
Check Kodi Settings:
Settings → Add-ons → Manage dependencies
Settings → Add-ons → Check for updates
Review all installed repositories
Remove unknown/untrusted sources
Remediation
| Issue | Action |
|---|---|
| Malicious add-on | Remove add-on and repo |
| Cryptominer | Remove, reset Kodi profile |
| Botnet | Full system scan, rebuild |
| Unknown repos | Remove and audit |
Investigation Checklist
Investigation Checklist
Installation Analysis
- Is Kodi officially installed?
- Was it pre-installed on a device?
- What version is running?
Add-on Audit
- What add-ons are installed?
- What repositories are configured?
- Are there add-ons from unknown sources?
- When were add-ons last updated?
Network Analysis
- What hosts is Kodi connecting to?
- Are there mining pool connections?
- Is there unusual outbound traffic?
- Are there connections to known bad IPs?
Process Analysis
- Is Kodi spawning child processes?
- Is Python being executed by Kodi?
- What is CPU usage during Kodi operation?