INC/Gentlemen Ransomware Affiliate C2 and Tunneling Tool Execution (Sliver, RevS

Suraj A@cytech

•updated yesterday•0•0•6

Detects process creation of known C2 and tunneling tools associated with INC and The Gentlemen ransomware affiliates, including Sliver, RevSocks, Ghost C2, Athena, QuickLine, and Phantom, by matching image names, original file names, or command-line arguments.