All Detections

Linux Lazarus Badcall Log Creation

avatar
Tim Peck@timpeck
updated Dec 19, 2025073

Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.

YARA-L