c-ares Vulnerable Library Linkage Discovery - ldd/readelf/strings Reconnaissance
Detects reconnaissance activities aimed at identifying c-ares library linkage using tools like ldd, readelf, and strings, or via pattern matching in files. It also monitors for the suspicious loading of cares.dll outside of expected vendor directories and the execution of specific files identified as part of a c-ares TCP use-after-free proof-of-concept.
Microsoft Sentinel (KQL)
