Trojanized atd/agetty/polkitd binaries beaconing to CurlRAT C2 domains
Detects network connections from common Linux system binaries (agetty, atd, polkitd, crond) to identified suspicious external domains. These binaries typically do not communicate with external internet services, suggesting potential process masquerading or compromise.
Microsoft Sentinel (KQL)
