GSocket Activity and Web Server Script Download on Linux
Finds GSocket activity on Linux endpoints. The query matches known tool names, hashes and relay hosts from Microsoft's report. It also looks for behavior: a web server runtime starting a shell that pipes a download into it, execution from hidden folders in /dev/shm, processes renamed to look like kernel threads and persistence files written by web runtimes.
Microsoft Sentinel (KQL)
