Velvet Ant GS-Netcat Encrypted Tunnel and SOCKS Proxy Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.