Velvet Ant uptime binary masquerading or replacement on Linux host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious activity involving the uptime utility on Linux systems. This includes execution from non-standard paths, invocation with unexpected command-line arguments, execution with unusual parent processes, or evidence of the uptime binary being overwritten or written to a non-standard location. Such behavior is often indicative of masquerading or attempts to hide malicious activities.