DOGLEASH-style backdoor: listener setup followed by shell exec and file rename/read

Duo Tech@duotech

•updated Jul 7, 2026•1•0•5

This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.