Threat video1:00
GSocket gs-netcat Relay C2 on Linux: Detection & IOCs
Threat actors keep GSocket on compromised Linux web servers as a relay-based C2 backdoor, with 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for GSocket gs-netcat Relay C2 on Linux: Detection & IOCs →
Chapters
- 0:00The hookPatched servers still hid intruders.
- 0:04The storyUnrelated actors deployed GSocket.
- 0:11Attack pathAttackers exploit web apps, then install GSocket.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise20 indicators to hunt: 1 IP, 3 domains and 4 URLs, and more.
- 0:37MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation4 steps now: Hunt for GSocket artifacts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Patched servers still hid intruders.
0:05Unrelated actors deployed GSocket.
0:08Patching did not evict them.
0:11Attackers exploit web apps, then install GSocket.
0:14It stages in hidden paths.
0:16Traffic flows through a shared relay.
0:19Cron and systemd keep it alive.
0:21Timestamps reset to hide changes.
0:26No threat actor is attributed. Confidence: low.
0:3120 indicators to hunt: 1 IP, 3 domains and 4 URLs, and more.
0:3813 ATT&CK techniques, from initial access to command and control.
0:434 steps now: Hunt for GSocket artifacts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.