==================================================

CREATED: NIX-WHOIS-TRANSFER (#1845)

Description

This detector identifies the binary 'whois' being used as a means of transferring files. This is uncommon activity for the whois tool and is indicative of suspicious activity.

Did this answer your question?