DOGLEASH backdoor shell command execution via /bin/sh -c

Ethan Andrews@eandrews

•updated Jul 7, 2026•1•0•3

Detects the DOGLEASH backdoor utilizing /bin/sh -c to execute arbitrary shell commands. The detection specifically looks for the execution of the Unix shell with -c arguments triggered by parent process command lines containing specific C2 command codes (0x2268 or 0x2267).