Velvet Ant GS-Netcat Reverse Shell Deployed as Systemd Service

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.