Mal Lin Zinfoq Implant

Daniel Jeremiah@daniyyell

•updated Dec 13, 2025•2•0•69

Detects the ZinFoq Go-based post-exploitation implant. This rule identifies the binary based on a unique, hardcoded timestamp string used for its timestomping anti-forensics feature, along with other specific C2 artifacts.