Ivanti Connect Secure - System Library and Perl Module Tampering
Detects modification of core Ivanti Connect Secure system files on the appliance. Attackers patch shared libraries and Perl modules such as /home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is loaded by legitimate services, blending malicious code into normal appliance operation and surviving reboots.
YARA-L
