GS-Netcat Reverse Shell Deployment - Velvet Ant Operation Highland (MDE)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.