BARECLAW ingredi_ws SOCKS5-over-WebSocket tunneler launched from /tmp

Arnold Chan@slaz

•updated 3 days ago•0•0•0

Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.