Velvet Ant - Malicious 'uptime' Binary Masquerading as System Utility

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.