Velvet Ant Perl SOCKS Proxy Masquerading as smbd on Port 5000
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
YARA-L
