Velvet Ant GS-Netcat SOCKS Proxy Masquerading as smbd -D
This rule detects the execution of 'gs-netcat' or 'gsocket' utilities, as well as specific configurations of 'smbd' that suggest potential use of network tools for remote command and control or unauthorized access. GSocket allows for the creation of secure reverse shells and peer-to-peer communication channels, which are often used by adversaries to bypass firewall restrictions.
CQL
