[mschuster91]

The benefit is that it won't readily show up on an audit like an iptables backdoor would.

[tsujamin]

Yeah like all the above IMO the tool is already on the machine and it’s not a typical (read: looked for) technique