Velvet Ant: uptime Binary Masquerade Network Activity or Systemd Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.