GSocket Installer Download or Execution for Remote Access Tunnel

Renata Cardoso@rcardososec

•updated Jul 2, 2026•0•0•7

Detects the execution, network activity, or installation of GSocket (gsocket/gs-netcat) tools used for creating remote access tunnels. The rule also identifies instances where the legitimate 'uptime' binary is masqueraded to execute GSocket commands or establish unauthorized network connections.