The Gentlemen Go Backdoor C2 to 81.177.215.15:9443 with Yamux and SOCKS Pivoting
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Splunk (SPL)
