Velvet Ant GS-Netcat Reverse Shell Masquerading as System Component
Detects the execution of GSocket (gs-netcat), a network tool often used for establishing persistent backdoors, interactive shells, or SOCKS proxies. The rule identifies execution with common flags for daemonization, interactive shell access, or SOCKS proxying, as well as instances where the process masquerades as common system binaries (e.g., smbd, sshd) or is initiated from system persistence directories like systemd or init.d.
Cortex XDR
