Terraform provider execution spawning detached 'go run .' (Graphalgo)

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•3

Detects instances where a Terraform process or its associated provider plugins spawn a Go toolchain process (go.exe) to execute a local package. This pattern is associated with malicious Terraform providers that use this technique to bootstrap second-stage payloads such as the Graphalgo RAT.