Tag
The socat utility is being identified in malicious contexts when used with local terminal echo disabled and configured for remote TCP or OpenSSL connections, often indicating C2 or lateral movement.