The Gentlemen Go Backdoor WMI UUID Recon and CMD Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a Go-based backdoor associated with 'The Gentlemen' ransomware group executing commands via cmd.exe. The rule monitors for a specific pattern of WMI UUID queries alongside command-line execution of system discovery tools (whoami, net group, dir) via cmd.exe /c, which is indicative of remote command execution over a Yamux C2 channel.