SPECTRALVIPER XGU::Feature::Pivot Network Tunneling Strings in Memory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of SPECTRALVIPER malware by identifying unique RTTI class name strings ('XGU::Feature::Pivot', 'XGU::Pivot::StartLink', 'XGU::Pivot::Internal::WaitNew_RemotePipe') within command lines. These strings are associated with internal network tunneling and proxy pivoting functionality within the XGU framework.