Velvet Ant - SELinux Evasion via SCP (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.