Velvet Ant GS-Netcat/GSSocket Encrypted Tunnel Execution on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.