Gentlemen - Go Build Artifact Execution (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies characteristics of compiled Go binaries (e.g., executing from temp with specific build path signatures in memory) taking malicious actions. This rule specifically looks for process execution of an executable, combined with network connections on port 445 (SMB), and the creation or modification of files ending with '.gentlemen'.