Velvet Ant GS-Netcat Reverse Shell Systemd Persistence via Suspicious Service Unit

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized systemd service unit installation or modification, specifically targeting reverse shells or encrypted tunneling tools (e.g., gs-netcat, netcat) by monitoring systemctl commands referencing suspicious paths (/tmp, /var/tmp, etc.) that bypass standard package management workflows. This behavior is associated with the Velvet Ant threat group's persistence tactics on compromised Linux systems.