Velvet Ant 'uptime' FastCGI bridge spawning SSH into isolated network
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
YARA-L
