Velvet Ant GS-Netcat Backdoor Service - gs-netcat or uptime masquerade

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.