Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp)

Renata Cardoso@rcardososec

•updated Jul 2, 2026•0•0•26

Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp) or command-line patterns typically used for remote shell access or socket redirection, such as using -e with a shell, -l/-p for listening, or redirecting I/O from common temporary directories.