BIOC
Medium
✕
Gost tunneling execution
Possible use of Gost (tunnel written in Golang) SSH tunnel.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Protocol Tunneling (T1572)
Indicator:
Process action type = execution AND target process cmd = *rtcp://*socks5* , *rtcp://*socks4* , *rudp://*socks5* , *rudp://*socks4*
Preventable: yes