Linux os-release Read from Unexpected Binary Followed by Outbound Connection
Detects a read of /etc/os-release by a binary outside known system-utility paths, a precursor to the Rust-based RAT's host-fingerprinting telemetry; paired with a correlation rule requiring a subsequent outbound connection from the same binary to reduce noise.
Sigma
