GRAYRABBIT-style cmd.exe Piped Reverse Shell w/ Network Correlation

Arnold Chan@slaz

•updated 27 days ago•0•0•0

Detects the suspicious execution of cmd.exe with piped stdio handles (indicative of a reverse shell) initiated by non-standard parent processes associated with the GRAYRABBIT malware, correlated with an immediate outbound network connection from the same process.