PoeLLM libgcrypt ELF with C2 port 9999 connection spawning a shell
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Microsoft Sentinel (KQL)
