DOGLEASH iptables rule insertion to allow inbound backdoor port
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Microsoft Sentinel (KQL)

