Velvet Ant GS-Netcat C2 tunnel or uptime masquerade on Linux host
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
Splunk (SPL)
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
Already have an account?