GSocket reverse-shell persistence via cron job deployment
Detects the deployment and execution of GSocket-based persistence mechanisms on Linux systems. This includes monitoring for the use of deployment scripts (gs_deploy.py, gs_persist.py), the establishment of cron jobs for periodic GSocket check-ins, the use of GSOCKET_HOST environment variables to control network behavior, and the execution of GSocket binaries staged in suspicious locations such as /tmp/.gs or web server directories.
Microsoft Sentinel (KQL)
