macOS Gaslight Rust Backdoor - Suspicious Binary Network C2 Activity

Ankit Mehta@Secvyn

•updated Jun 29, 2026•3•0•7

Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.