Velvet Ant Perl SOCKS Proxy Masquerading as smbd -D Daemon
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Cortex XDR
