CL-STA-1132 Tunneling Tools File Creation
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories. These file names are highly specific to the CL-STA-1132 campaign.
Cortex XDR
