CurlRAT watchdog polling /var/run/haproxy.pid and reporting via writeservice_inf

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•0

This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.