Tunneling Tools File Creation (EarthWorm, ReverseSocks5)

Thiru N@Iamthiru

•updated May 8, 2026•7•0•1,175

Detects the creation of specific file names associated with EarthWorm and ReverseSocks5 tunneling tools in common temporary directories (/tmp/ and /var/tmp/) on Linux systems. These tools are often used for command and control and data exfiltration.