CurlRAT PTY Reverse Shell via Trojanized atd/crond/agetty Binary
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Microsoft Sentinel (KQL)
